In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845 cve-icon cve-icon
https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb cve-icon cve-icon
https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56 cve-icon cve-icon
https://git.kernel.org/stable/c/6a810c462f099353e908c70619638884cb82229c cve-icon cve-icon
https://git.kernel.org/stable/c/8e8f1ddf4186731649df8bc9646017369eb19186 cve-icon cve-icon
https://git.kernel.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3 cve-icon cve-icon
https://git.kernel.org/stable/c/ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d cve-icon cve-icon
https://git.kernel.org/stable/c/bc7b5f782d28942dbdfda70df30ce132694a06de cve-icon cve-icon
https://git.kernel.org/stable/c/d0d21c8e44216fa9afdb3809edf213f3c0a8c060 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025041633-CVE-2025-23136-75e1@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-23136 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-23136 cve-icon
History

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Wed, 01 Oct 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Fri, 18 Apr 2025 02:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 16 Apr 2025 14:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ]
Title thermal: int340x: Add NULL check for adev
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-04-16T14:13:16.439Z

Updated: 2025-11-03T19:42:20.085Z

Reserved: 2025-01-11T14:28:41.511Z

Link: CVE-2025-23136

cve-icon Vulnrichment

Updated: 2025-11-03T19:42:20.085Z

cve-icon NVD

Status : Modified

Published: 2025-04-16T15:16:07.970

Modified: 2025-11-03T20:17:44.687

Link: CVE-2025-23136

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-16T00:00:00Z

Links: CVE-2025-23136 - Bugzilla