---
id: CVE-2025-39937
title: 'net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

  Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
  device property") r…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    184f608a68f96794e8fe58cd5535014d53622cde
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    8793e7a8e1b60131a825457174ed6398111daeb7
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    ada2282259243387e6b6e89239aeb4897e62f051
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    47ade5f9d70b23a119ec20b1c6504864b2543a79
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    689aee35ce671aab752f159e5c8e66d7685e6887
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    21ba85d9d508422ca9e6698463ff9357c928c22d
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d
  - >-
    Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f <
    b6f56a44e4c1014b08859dcf04ed246500e310e5
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:13:07.142657Z'
published: '2025-10-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:06.763Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39937'
references:
  - url: 'https://git.kernel.org/stable/c/184f608a68f96794e8fe58cd5535014d53622cde'
  - url: 'https://git.kernel.org/stable/c/8793e7a8e1b60131a825457174ed6398111daeb7'
  - url: 'https://git.kernel.org/stable/c/ada2282259243387e6b6e89239aeb4897e62f051'
  - url: 'https://git.kernel.org/stable/c/47ade5f9d70b23a119ec20b1c6504864b2543a79'
  - url: 'https://git.kernel.org/stable/c/689aee35ce671aab752f159e5c8e66d7685e6887'
  - url: 'https://git.kernel.org/stable/c/21ba85d9d508422ca9e6698463ff9357c928c22d'
  - url: 'https://git.kernel.org/stable/c/21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d'
  - url: 'https://git.kernel.org/stable/c/b6f56a44e4c1014b08859dcf04ed246500e310e5'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.04188
ingestedAt: '2026-11-05T22:38:32.050Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
device property") rfkill_find_type() gets called with the possibly
uninitialized "const char *type_name;" local variable.

On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:

        rfkill->type = (unsigned)id->driver_data;

and there is no "type" property so device_property_read_string() will fail
and leave type_name uninitialized, leading to a potential crash.

rfkill_find_type() does accept a NULL pointer, fix the potential crash
by initializing type_name to NULL.

Note likely sofar this has not been caught because:

1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
2. The stack happened to contain NULL where type_name is stored

## Affected

- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 184f608a68f96794e8fe58cd5535014d53622cde`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 8793e7a8e1b60131a825457174ed6398111daeb7`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < ada2282259243387e6b6e89239aeb4897e62f051`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 47ade5f9d70b23a119ec20b1c6504864b2543a79`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 689aee35ce671aab752f159e5c8e66d7685e6887`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 21ba85d9d508422ca9e6698463ff9357c928c22d`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < 21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d`
- `Linux >= 7d5e9737efda16535e5b54bd627ef4881d11d31f < b6f56a44e4c1014b08859dcf04ed246500e310e5`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.