CVE-2025-37972 describes a null pointer dereference vulnerability in the Linux kernel's mtk-pmic-keys input driver. The vulnerability arises in the mtk_pmic_keys_probe function where the regs parameter is only set if the button is parsed in the device tree. On hardware where the button node is removed (left floating), the code attempts to dereference a null pointer, causing a potential crash or denial of service. The fix involves using a regs struct that is defined across all supported platforms, preventing null dereference. This vulnerability is one among several security issues fixed in the Linux kernel affecting various subsystems including input device core drivers. The vendor advisory from Ubuntu confirms the availability of patches in Linux kernel versions 6.14 and related HWE kernels.

The vulnerability can cause a null pointer dereference leading to a denial of service (system crash) on affected Linux kernel versions. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting local attack vector with low complexity and no privileges required beyond local user, no user interaction, and impact limited to availability.

A patch is available and has been released by the vendor. Users should update their Linux kernel packages to the fixed versions as listed in the Ubuntu security advisories USN-7699-1 and USN-7699-2. After applying the update, a system reboot is required to complete the remediation. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigations are indicated by the vendor advisory.