CVE-2025-21982: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was identified in the Linux kernel affecting the pinctrl subsystem, specifically in the Nuvoton NPCM8xx GPIO firmware component. The issue was discovered and disclosed on April 1, 2025. The vulnerability affects Linux kernel versions from 6.7 up to (excluding) 6.12.20, as well as various release candidates of version 6.14 (NVD).

The vulnerability stems from unchecked return values from devmkasprintf() calls in the npcm8xxgpio_fw() function. When these calls fail, they return null pointers, but the code did not properly validate these return values, potentially leading to a NULL pointer dereference error. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can lead to a kernel NULL pointer dereference, which typically results in a system crash or denial of service condition. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability has been resolved by adding NULL pointer checks in the npcm8xxgpiofw() function. The fix has been implemented through patches available in the Linux kernel repository. System administrators should update affected systems to patched versions of the Linux kernel (NVD).