CVE-2025-23147

MEDIUM

Linux Kernel - NULL Pointer Dereference in i3c_master_queue_ibi()

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls `i3c_master_queue_ibi()` to queue an IBI work task, leading to "Unable to handle kernel read from unreadable memory" and resulting in a kernel panic. Typical IBI handling flow: 1. The I3C master scans target devices and probes their respective drivers. 2. The target device driver calls `i3c_device_request_ibi()` to enable IBI and assigns `dev->ibi = ibi`. 3. The I3C master receives an IBI from the target device and calls `i3c_master_queue_ibi()` to queue the target device driver’s IBI handler task. However, since target device events are asynchronous to the I3C probe sequence, step 3 may occur before step 2, causing `dev->ibi` to be `NULL`, leading to a kernel panic. Add a NULL pointer check in `i3c_master_queue_ibi()` to prevent accessing an uninitialized `dev->ibi`, ensuring stability.

Scores

CVSS v3 5.5
EPSS 0.0006
EPSS Percentile 19.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (30)
debian/debian_linux 11.0
linux/Kernel 5.0.0 - 5.4.293linux
linux/Kernel 5.11.0 - 5.15.181linux
linux/Kernel 5.16.0 - 6.1.135linux
linux/Kernel 5.5.0 - 5.10.237linux
linux/Kernel 6.13.0 - 6.13.12linux
linux/Kernel 6.14.0 - 6.14.3linux
linux/Kernel 6.2.0 - 6.6.88linux
linux/Kernel 6.7.0 - 6.12.24linux
Linux/Linux < 5.0
... and 20 more
Published May 01, 2025
Tracked Since Feb 18, 2026