CVE-2025-38053

idpf: fix null-ptr-deref in idpf_features_check

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix null-ptr-deref in idpf_features_check

idpf_features_check is used to validate the TX packet. skb header

length is compared with the hardware supported value received from

the device control plane. The value is stored in the adapter structure

and to access it, vport pointer is used. During reset all the vports

are released and the vport pointer that the netdev private structure

points to is NULL.

To avoid null-ptr-deref, store the max header length value in netdev

private structure. This also helps to cache the value and avoid

accessing adapter pointer in hot path.

BUG: kernel NULL pointer dereference, address: 0000000000000068

...

RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf]

Call Trace:

<TASK>

? __die+0x23/0x70

? page_fault_oops+0x154/0x520

? exc_page_fault+0x76/0x190

? asm_exc_page_fault+0x26/0x30

? idpf_features_check+0x6d/0xe0 [idpf]

netif_skb_features+0x88/0x310

validate_xmit_skb+0x2a/0x2b0

validate_xmit_skb_list+0x4c/0x70

sch_direct_xmit+0x19d/0x3a0

__dev_queue_xmit+0xb74/0xe70

...

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Published
2025-06-18T09:33Z
EPSS history
Timeline
  • 18 JUN 09:33Z
    idpf: fix null-ptr-deref in idpf_features_check
    cvelistv5