CVE-2025-23146 – This CVE describes a NULL pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2025-23146?

CVE-2025-23146 has a CVSS score of 5.5 (MEDIUM). This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's ENE-KB3930 MFD driver. If exploited, it could cause a kernel panic or system crash on systems using this specific hardware driver. Only Linux systems with the ENE-KB3930 hardware and the vulnerable driver are affected.

📋 TL;DR

This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's ENE-KB3930 MFD driver. If exploited, it could cause a kernel panic or system crash on systems using this specific hardware driver. Only Linux systems with the ENE-KB3930 hardware and the vulnerable driver are affected.

💻 Affected Systems

Products:

Linux kernel ENE-KB3930 MFD driver

Versions: Linux kernel versions containing the vulnerable ENE-KB3930 driver code before the fix commits

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ENE-KB3930 hardware is present and the driver is loaded. Most systems won't have this specific hardware.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical reboot.

🟠

Likely Case

System instability or crash when the ENE-KB3930 hardware is initialized, requiring reboot to recover.

🟢

If Mitigated

No impact if the vulnerable driver is not loaded or the hardware is not present.

🌐 Internet-Facing: LOW - This is a local kernel driver vulnerability requiring local access or kernel module loading.

🏢 Internal Only: MEDIUM - Could be exploited by local users or through other vulnerabilities to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access to trigger the vulnerable code path. Could be chained with other vulnerabilities.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing the fix commits: 2edb5b29b197d90b4d08cd45e911c0bcf24cb895, 4cdf1d2a816a93fa02f7b6b5492dc7f55af2a199, 6dc88993ee3fa8365ff6a5d6514702f70ba6863a, 76d0f4199bc5b51acb7b96c6663a8953543733ad, 7b47df6498f223c8956bfe0d994a0e42a520dfcd

Vendor Advisory: https://git.kernel.org/stable/c/2edb5b29b197d90b4d08cd45e911c0bcf24cb895

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify driver is no longer vulnerable.

🔧 Temporary Workarounds

Disable ENE-KB3930 driver

linux

Prevent loading of the vulnerable driver module

echo 'blacklist ene-kb3930' >> /etc/modprobe.d/blacklist.conf
rmmod ene-kb3930

Remove ENE-KB3930 hardware

all

Physically remove the ENE-KB3930 hardware if present

🧯 If You Can't Patch

Ensure no local users have unnecessary privileges to load kernel modules
Monitor system logs for kernel panics or crashes related to ENE-KB3930 driver

🔍 How to Verify

Check if Vulnerable:

Check if ENE-KB3930 driver is loaded: lsmod | grep ene-kb3930. Check kernel version against vulnerable versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check driver loads without issues.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in dmesg
System crash/reboot events

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "ene-kb3930" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-23146

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.03% exploit probability (6.2th percentile)

Published: May 1, 2025

Last Updated: November 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-23146, you might also want to check these: