Listen to this Post
How the CVE Works
The vulnerability exists within the MediaTek MT7996 Wi-Fi chipset driver in the Linux kernel. The function `mt7996_thermal_init()` uses `devm_kasprintf()` to dynamically allocate memory for a string. If `devm_kasprintf()` fails, it returns a NULL pointer instead of a valid string. The code proceeds to use this NULL pointer without first checking if the allocation was successful. This leads to a kernel NULL pointer dereference when the code attempts to access the memory pointed to by the NULL pointer. Such a dereference typically causes a kernel panic, resulting in a full system crash and denial of service.
Platform: Linux Kernel
Version: MediaTek MT7996 driver
Vulnerability: NULL Pointer Dereference
Severity: Medium
date: 07/10/2025
Prediction: Patch expected by 07/24/2025
What Undercode Say:
git log --oneline --grep="mt7996_thermal_init" cat /proc/version dmesg | grep -i "panic|Oops"
// Vulnerable code snippet (conceptual) cooling = devm_kasprintf(); // Can return NULL strcpy(cooling_device_name, cooling); // Potential crash here // Patched code cooling = devm_kasprintf(); if (!cooling) return -ENOMEM;
How Exploit:
A local user can trigger the flaw by attempting to read from the thermal sysfs interface for the affected Wi-Fi device, causing a kernel panic and system crash.
Protection from this CVE
Apply kernel patch.
Impact:
Denial of Service (System Crash).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
