Linux Kernel Vulnerability in RFKill due to Uninitialized Pointer Dereference

CVE-2025-39937

What is CVE-2025-39937?

A notable vulnerability exists within the Linux kernel's RFKill functionality, triggered by an uninitialized pointer dereference during operations involving specific ACPI devices such as 'BCM4752' or 'LNV4752'. The issue arises when the rfkill-gpio module binds to these devices and fails to read the required 'type' property, causing the kernel to attempt dereferencing a NULL pointer. Although this issue has gone largely unnoticed due to the rarity of affected hardware configurations, it poses a risk of system crashes, necessitating immediate attention for proper device handling.

References