CVE-2025-23136

What it actually does

NULL pointer dereference in int3402_thermal_probe() when ACPI companion fwnode is absent, allowing adev to be NULL and triggering a crash or memory corruption during device probe.

Why it matters to the business

Kernel instability or crashes on affected Linux systems during thermal device initialization can lead to unexpected downtime, loss of thermal management, and operational disruption especially in environments with high device enumeration activity.

How an attack unfolds

An attacker with local access crafts or triggers device probe conditions on hardware lacking an ACPI companion fwnode; the missing NULL check allows dereference of adev in int3402_thermal_probe(), resulting in kernel panic or potential privilege escalation similar to other recent Linux kernel memory corruption flaws.

How to fix it

Apply the upstream fix commit d0d21c8e44216fa9afdb3809edf213f3c0a8c060 or later; for Red Hat Enterprise Linux 9 appstream packages update gstreamer1-plugins-base and related subpackages to 0:1.22.1-3.el9_5 or newer; verify the NULL check for adev is present before returning -ENODEV.

How to confirm the fix worked

Confirm the patch is applied by inspecting int3402_thermal_probe() for the adev NULL check; test on systems without ACPI fwnode to ensure -ENODEV is returned cleanly instead of dereferencing NULL; review kernel logs for absence of related oops or panic messages during probe.

Typical attack path

1. Obtain local access or execute code on target Linux system
2. Trigger thermal/int340x device enumeration or module load
3. Ensure target device lacks ACPI companion fwnode so adev remains NULL
4. Execute int3402_thermal_probe() path to dereference NULL pointer
5. Cause kernel crash or attempt to leverage corruption for privilege escalation

How to detect it

Review kernel logs for NULL pointer dereference oops in int3402_thermal_probe or int340x paths; look for unexpected thermal driver failures during boot or module load on systems without ACPI companions; correlate with recent device enumeration events.

What your security team should do

• Prioritize patching Linux kernel and affected packages within 30 days given ongoing kernel privilege-escalation activity
• Monitor for devices without ACPI companions during thermal driver initialization
• Restrict unprivileged local access until patches are deployed
• Test thermal probe paths in staging environments before broad rollout