CVE-2025-38123

net: wwan: t7xx: Fix napi rx poll issue

published July 3, 2025

CVSS
—
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: Fix napi rx poll issue

When driver handles the napi rx polling requests, the netdev might

have been released by the dellink logic triggered by the disconnect

operation on user plane. However, in the logic of processing skb in

polling, an invalid netdev is still being used, which causes a panic.

BUG: kernel NULL pointer dereference, address: 00000000000000f1

Oops: 0000 [#1] PREEMPT SMP NOPTI

RIP: 0010:dev_gro_receive+0x3a/0x620

[...]

Call Trace:

<IRQ>

? __die_body+0x68/0xb0

? page_fault_oops+0x379/0x3e0

? exc_page_fault+0x4f/0xa0

? asm_exc_page_fault+0x22/0x30

? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]

? dev_gro_receive+0x3a/0x620

napi_gro_receive+0xad/0x170

t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]

t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]

net_rx_action+0x103/0x470

irq_exit_rcu+0x13a/0x310

sysvec_apic_timer_interrupt+0x56/0x90

</IRQ>

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00465 · 39.3th percentile
Published
2025-07-03T08:35Z
EPSS history
Timeline
  • 03 JUL 08:35Z
    net: wwan: t7xx: Fix napi rx poll issue
    cvelistv5