CVE-2025-22084 (GCVE-0-2025-22084)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-05-11 21:12
VLAI
Title
w1: fix NULL pointer dereference in probe
Summary
In the Linux kernel, the following vulnerability has been resolved: w1: fix NULL pointer dereference in probe The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3c08804364e80328a9ffdac59bb26676b938195 , < 4f750b84628080ff0d67bf1af67a4967b740acf2 (git)
Affected: a3c08804364e80328a9ffdac59bb26676b938195 , < 64ab50577c59bb7049bec6b5c42d1c38e4029f29 (git)
Affected: a3c08804364e80328a9ffdac59bb26676b938195 , < cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298 (git)
Affected: a3c08804364e80328a9ffdac59bb26676b938195 , < 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.23 , ≤ 6.12.* (semver)
Unaffected: 6.13.11 , ≤ 6.13.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/w1/masters/w1-uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f750b84628080ff0d67bf1af67a4967b740acf2",
              "status": "affected",
              "version": "a3c08804364e80328a9ffdac59bb26676b938195",
              "versionType": "git"
            },
            {
              "lessThan": "64ab50577c59bb7049bec6b5c42d1c38e4029f29",
              "status": "affected",
              "version": "a3c08804364e80328a9ffdac59bb26676b938195",
              "versionType": "git"
            },
            {
              "lessThan": "cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298",
              "status": "affected",
              "version": "a3c08804364e80328a9ffdac59bb26676b938195",
              "versionType": "git"
            },
            {
              "lessThan": "0dd6770a72f138dabea9eae87f3da6ffa68f0d06",
              "status": "affected",
              "version": "a3c08804364e80328a9ffdac59bb26676b938195",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/w1/masters/w1-uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: fix NULL pointer dereference in probe\n\nThe w1_uart_probe() function calls w1_uart_serdev_open() (which includes\ndevm_serdev_device_open()) before setting the client ops via\nserdev_device_set_client_ops(). This ordering can trigger a NULL pointer\ndereference in the serdev controller\u0027s receive_buf handler, as it assumes\nserdev-\u003eops is valid when SERPORT_ACTIVE is set.\n\nThis is similar to the issue fixed in commit 5e700b384ec1\n(\"platform/chrome: cros_ec_uart: properly fix race condition\") where\ndevm_serdev_device_open() was called before fully initializing the\ndevice.\n\nFix the race by ensuring client ops are set before enabling the port via\nw1_uart_serdev_open()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:12:20.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f750b84628080ff0d67bf1af67a4967b740acf2"
        },
        {
          "url": "https://git.kernel.org/stable/c/64ab50577c59bb7049bec6b5c42d1c38e4029f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dd6770a72f138dabea9eae87f3da6ffa68f0d06"
        }
      ],
      "title": "w1: fix NULL pointer dereference in probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22084",
    "datePublished": "2025-04-16T14:12:32.950Z",
    "dateReserved": "2024-12-29T08:45:45.816Z",
    "dateUpdated": "2026-05-11T21:12:20.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22084",
      "date": "2026-09-27",
      "epss": "0.00201",
      "percentile": "0.0897"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/w1/masters/w1-uart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4f750b84628080ff0d67bf1af67a4967b740acf2",
                    "status": "affected",
                    "version": "a3c08804364e80328a9ffdac59bb26676b938195",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "64ab50577c59bb7049bec6b5c42d1c38e4029f29",
                    "status": "affected",
                    "version": "a3c08804364e80328a9ffdac59bb26676b938195",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298",
                    "status": "affected",
                    "version": "a3c08804364e80328a9ffdac59bb26676b938195",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0dd6770a72f138dabea9eae87f3da6ffa68f0d06",
                    "status": "affected",
                    "version": "a3c08804364e80328a9ffdac59bb26676b938195",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/w1/masters/w1-uart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10F3EB18-ACA3-4775-AC8D-C1CC227D2763",
                    "versionEndExcluding": "6.12.23",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E864B0-8C00-4679-BA55-659B4C9C3AD3",
                    "versionEndExcluding": "6.13.11",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0",
                    "versionEndExcluding": "6.14.2",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: fix NULL pointer dereference in probe\n\nThe w1_uart_probe() function calls w1_uart_serdev_open() (which includes\ndevm_serdev_device_open()) before setting the client ops via\nserdev_device_set_client_ops(). This ordering can trigger a NULL pointer\ndereference in the serdev controller\u0027s receive_buf handler, as it assumes\nserdev-\u003eops is valid when SERPORT_ACTIVE is set.\n\nThis is similar to the issue fixed in commit 5e700b384ec1\n(\"platform/chrome: cros_ec_uart: properly fix race condition\") where\ndevm_serdev_device_open() was called before fully initializing the\ndevice.\n\nFix the race by ensuring client ops are set before enabling the port via\nw1_uart_serdev_open()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: w1: correcci\u00f3n de la desreferencia de puntero nulo en la sonda. La funci\u00f3n w1_uart_probe() llama a w1_uart_serdev_open() (que incluye devm_serdev_device_open()) antes de configurar las operaciones del cliente mediante serdev_device_set_client_ops(). Este orden puede desencadenar una desreferencia de puntero nulo en el controlador receive_buf del controlador serdev, ya que asume que serdev-\u0026gt;ops es v\u00e1lido cuando SERPORT_ACTIVE est\u00e1 configurado. Esto es similar al problema corregido en el commit 5e700b384ec1 (\"platform/chrome: cros_ec_uart: corregir correctamente la condici\u00f3n de ejecuci\u00f3n\") donde se llam\u00f3 a devm_serdev_device_open() antes de inicializar completamente el dispositivo. Corrija la ejecuci\u00f3n asegur\u00e1ndose de que las operaciones del cliente est\u00e9n configuradas antes de habilitar el puerto mediante w1_uart_serdev_open()."
          }
        ],
        "id": "CVE-2025-22084",
        "lastModified": "2026-06-17T08:45:00.683",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-16T15:16:02.607",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0dd6770a72f138dabea9eae87f3da6ffa68f0d06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f750b84628080ff0d67bf1af67a4967b740acf2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/64ab50577c59bb7049bec6b5c42d1c38e4029f29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cc6b0ec7cccbf66ef3621e9e93296b7bd1f52298"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:19:10+00:00",
      "cve": "CVE-2025-22084",
      "id": "CVE-2025-22084",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: w1: fix NULL pointer dereference in probe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22084.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:02:37Z",
      "cve": "CVE-2025-22084",
      "id": "CVE-2025-22084",
      "initial_release_date": "2025-04-18T01:23:41Z",
      "product_status:known_not_affected": "467",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22084",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22084.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.