NULL Pointer Dereference in Linux Kernel's PCMCIA Subsystem

CVE-2025-39846

What is CVE-2025-39846?

A vulnerability in the Linux kernel's PCMCIA subsystem can lead to a NULL pointer dereference during the resource allocation process. The issue arises in the __iodyn_find_io_region() function, where improper handling of resource assignment leads to potential system instability. If the pcmcia_make_resource() function fails, it results in a dereference of a NULL pointer, posing a risk during PCI bus resource allocation. To mitigate this issue, a check was implemented to verify the validity of the resource before its usage, enhancing the overall robustness of the kernel's resource management.

References