CVE-2025-39937

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s net/rfkill/gpio subsystem where an uninitialized pointer can lead to a crash. This issue arises from the rfkill find type() function being called with an uninitialized type name variable after a failure in device property read string(). This can occur on x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpi device, as the rfkill->type is set based on the ACPI acpi device id and no "type" property exists. The fix initializes type name to NULL, preventing the crash. It is noted that this issue may not have been widely observed due to the limited number of x86 machines with the affected acpi device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.