CVE-2025-22084

w1: fix NULL pointer dereference in probe

published April 16, 2025

CVSS
—
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

w1: fix NULL pointer dereference in probe

The w1_uart_probe() function calls w1_uart_serdev_open() (which includes

devm_serdev_device_open()) before setting the client ops via

serdev_device_set_client_ops(). This ordering can trigger a NULL pointer

dereference in the serdev controller's receive_buf handler, as it assumes

serdev->ops is valid when SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1

("platform/chrome: cros_ec_uart: properly fix race condition") where

devm_serdev_device_open() was called before fully initializing the

device.

Fix the race by ensuring client ops are set before enabling the port via

w1_uart_serdev_open().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Published
2025-04-16T14:12Z
EPSS history
Timeline
  • 16 APR 14:12Z
    w1: fix NULL pointer dereference in probe
    cvelistv5