CVE-2025-37792

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: Prevent potential NULL dereference

The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch:

drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < c3e9717276affe59fd8213706db021b493e81e34; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < 73dc99c0ea94abd22379b2d82cacbc73f3e18ec1; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < 2d7c60c2a38b4b461fa960ad0995136a6bfe0756; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < d8441818690d795232331bd8358545c5c95b6b72; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < 3db6605043b50c8bb768547b23e0222f67ceef3e; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < aaf356f872a60db1e96fb762a62c4607fd22741f; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < 53ceef799dcfc22c734d600811bfc9dd32eaea0a; >= 26503ad25de8c7c93a2037f919c2e49a62cf65f1, < 324dddea321078a6eeb535c2bff5257be74c9799
LinuxLinux4.19

References

Timeline

Published
May 1, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-377935.5In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() devm_kasCVE-2025-377945.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Purge vif txq in ieee80211_do_stop() After ieee80211_dCVE-2025-377967.8In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memorCVE-2025-377977.8In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch CVE-2025-377987.8In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() AftCVE-2025-377995.5In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 drCVE-2025-37806.5The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unautCVE-2025-378005.5In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() IfCVE-2025-378015.5In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the retuCVE-2025-378025.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_CVE-2025-378037.8In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by castCVE-2025-378055.5In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fix cancel_sync warnings on uninitialized work_structs B
CVE-2025-37792: Medium severity, CVSS 5.5 | Vulnix