Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38266— pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pinctrl-mediatek中的无效指针取消引用问题，可能导致系统崩溃。

AI Predicted 7.0 Difficulty: Theoretical EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 9

VendorProduct Version RangeStatus
Linux Linux 3cc64c13deb38080afc6b37060e825d4fe0a4737< eae2b12df3aac874566f7025799ca4219572e44c affected
7586766229354983cf5572f81295e69bf5abccf5< e578bbff985822573a27d4b7c9ec858e6014d033 affected
00f864b4b5ce3c50f3217626c8de97fbda1b2ea6< abe8ad6a1a00c5c7be28b038d0ede0bdcacd8610 affected
3ef9f710efcb5cc1335b5b09c16c757f703d7e5f< 9ebe21ede792cef851847648962c363cac67d17f affected
3ef9f710efcb5cc1335b5b09c16c757f703d7e5f< 1c9977b263475373b31bbf86af94a5c9ae2be42c affected
6.15 affected
< 6.15 unaffected
6.15.2≤ 6.15.* unaffected
… +1 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38266

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple addresses") introduced an access to the 'soc' field of struct mtk_pinctrl in mtk_eint_do_init() and for that an include of pinctrl-mtk-common-v2.h. However, pinctrl drivers relying on the v1 common driver include pinctrl-mtk-common.h instead, which provides another definition of struct mtk_pinctrl that does not contain an 'soc' field. Since mtk_eint_do_init() can be called both by v1 and v2 drivers, it will now try to dereference an invalid pointer when called on v1 platforms. This has been observed on Genio 350 EVK (MT8365), which crashes very early in boot (the kernel trace can only be seen with earlycon). In order to fix this, since 'struct mtk_pinctrl' was only needed to get a 'struct mtk_eint_pin', make 'struct mtk_eint_pin' a parameter of mtk_eint_do_init() so that callers need to supply it, removing mtk_eint_do_init()'s dependency on any particular 'struct mtk_pinctrl'.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pinctrl-mediatek中的无效指针取消引用问题，可能导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3cc64c13deb38080afc6b37060e825d4fe0a4737 ~ eae2b12df3aac874566f7025799ca4219572e44c -
Linux Linux 6.15 -

II. Public POCs for CVE-2025-38266

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38266

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38266 (3)

Same Patch Batch · Linux · 2025-07-10 · 84 CVEs total

CVE-2025-38325 9.8 CRITICAL ksmbd: add free_transport ops in ksmbd connection
CVE-2025-38290 8.8 HIGH wifi: ath12k: fix node corruption in ar->arvifs list
CVE-2025-38291 8.8 HIGH wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
CVE-2025-38283 8.8 HIGH hisi_acc_vfio_pci: bugfix live migration function without VF device driver
CVE-2025-38293 8.8 HIGH wifi: ath11k: fix node corruption in ar->arvifs list
CVE-2025-38292 8.8 HIGH wifi: ath12k: fix invalid access to memory
CVE-2025-38343 8.3 HIGH wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
CVE-2025-38333 7.8 HIGH f2fs: fix to bail out in get_new_segment()
CVE-2025-38303 7.8 HIGH Bluetooth: eir: Fix possible crashes on eir_create_adv_data
CVE-2025-38341 7.8 HIGH eth: fbnic: avoid double free when failing to DMA-map FW msg
CVE-2025-38276 7.8 HIGH fs/dax: Fix "don't skip locked entries when scanning entries"
CVE-2025-38346 7.8 HIGH ftrace: Fix UAF when lookup kallsym after ftrace disabled
CVE-2025-38321 7.8 HIGH smb: Log an error when close_all_cached_dirs fails
CVE-2025-38270 7.8 HIGH net: drv: netdevsim: don't napi_complete() from netpoll
CVE-2025-38306 7.8 HIGH fs/fhandle.c: fix a race in call of has_locked_children()
CVE-2025-38273 7.8 HIGH net: tipc: fix refcount warning in tipc_aead_encrypt
CVE-2025-38278 7.8 HIGH octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
CVE-2025-38339 7.8 HIGH powerpc/bpf: fix JIT code size calculation of bpf trampoline
CVE-2025-38317 7.8 HIGH wifi: ath12k: Fix buffer overflow in debugfs
CVE-2025-38287 7.5 HIGH IB/cm: Drop lockdep assert and WARN when freeing old msg

Showing top 20 of 84 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38266

No comments yet

Leave a comment