CVE-2025-37972

What it actually does

Null pointer dereference occurs in mtk_pmic_keys_probe when the device tree lacks a button node on floating hardware, causing the driver to attempt dereference of an unset regs parameter during initialization.

Why it matters to the business

Kernel instability or crash on affected embedded devices can lead to boot failures, loss of input functionality, and unplanned downtime requiring urgent patching across fleets.

How an attack unfolds

An attacker with local access or ability to influence device tree configuration triggers the probe path on hardware missing the button node, causing the null dereference and potential kernel panic or memory corruption that could be chained into privilege escalation.

How to fix it

Update the Linux kernel to the fixed commit 334d74a798463ceec02a41eb0e2354aaac0d6249 or apply the equivalent stable backport; rebuild and deploy the updated kernel image to all affected devices.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; test device tree configurations with and without the button node to verify no dereference occurs on probe.

Typical attack path

1. Identify or configure target hardware lacking the pmic-keys button node in device tree
2. Load or trigger the mtk-pmic-keys driver module during boot or runtime
3. Trigger null dereference in probe function
4. Exploit resulting memory corruption for denial of service or further escalation

How to detect it

Review kernel logs for oops or null pointer dereference messages during driver probe; inspect dmesg output and device tree blobs on affected systems for missing button nodes.

What your security team should do

• Prioritize kernel updates on all devices using mtk-pmic-keys driver
• Audit device trees for floating button configurations before deployment
• Monitor for kernel oops or panic logs related to input subsystem
• Test patched kernels in staging environments matching production hardware