NULL pointer dereference in Linux kernel intel int340x_thermal driver

1) NULL pointer dereference

EUVDB-ID: #VU107703

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-23136

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the int3402_thermal_probe() function in drivers/thermal/intel/int340x_thermal/int3402_thermal.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845
https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb
https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56
https://git.kernel.org/stable/c/6a810c462f099353e908c70619638884cb82229c
https://git.kernel.org/stable/c/8e8f1ddf4186731649df8bc9646017369eb19186
https://git.kernel.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3
https://git.kernel.org/stable/c/ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d
https://git.kernel.org/stable/c/bc7b5f782d28942dbdfda70df30ce132694a06de
https://git.kernel.org/stable/c/d0d21c8e44216fa9afdb3809edf213f3c0a8c060

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.