#VU109518 NULL pointer dereference in Linux kernel - CVE-2025-37972

Vulnerability identifier: #VU109518

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37972

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_pmic_keys_lp_reset_setup() function in drivers/input/keyboard/mtk-pmic-keys.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/09429ddb5a91e9e8f72cd18c012ec4171c2f85ec
https://git.kernel.org/stable/c/11cdb506d0fbf5ac05bf55f5afcb3a215c316490
https://git.kernel.org/stable/c/334d74a798463ceec02a41eb0e2354aaac0d6249
https://git.kernel.org/stable/c/619c05fb176c272ac6cecf723446b39723ee6d97
https://git.kernel.org/stable/c/90fa6015ff83ef1c373cc61b7c924ab2bcbe1801

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.