CVE-2025-21980

sched: address a potential NULL pointer dereference in the GRED scheduler.

Medium · published April 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sched: address a potential NULL pointer dereference in the GRED scheduler.

If kzalloc in gred_init returns a NULL pointer, the code follows the

error handling path, invoking gred_destroy. This, in turn, calls

gred_offload, where memset could receive a NULL pointer as input,

potentially leading to a kernel crash.

When table->opt is NULL in gred_init(), gred_change_table_def()

is not called yet, so it is not necessary to call ->ndo_setup_tc()

in gred_offload().

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Published
2025-04-01T15:47Z
EPSS history
Timeline
  • 01 APR 15:47Z
    sched: address a potential NULL pointer dereference in the GRED scheduler.
    cvelistv5