CVE-2025-39814CWE-476

CVE-2025-39814

Medium · published September 16, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset

Issuing a reset when the driver is loaded without RDMA support, will

results in a crash as it attempts to remove RDMA's non-existent auxbus

device:

echo 1 > /sys/class/net/<if>/device/reset

BUG: kernel NULL pointer dereference, address: 0000000000000008

...

RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice]

...

Call Trace:

<TASK>

ice_prepare_for_reset+0x77/0x260 [ice]

pci_dev_save_and_disable+0x2c/0x70

pci_reset_function+0x88/0x130

reset_store+0x5a/0xa0

kernfs_fop_write_iter+0x15e/0x210

vfs_write+0x273/0x520

ksys_write+0x6b/0xe0

do_syscall_64+0x79/0x3b0

entry_SYSCALL_64_after_hwframe+0x76/0x7e

ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but

pf->cdev_info will also be NULL, leading to the deref in the trace above.

Introduce a flag to be set when the creation of the auxbus device is

successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev().

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00130 · 2.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-09-16T17:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 6.16, < 6.16.56.16.5
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 16 SEP 13:00Z
    ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset
    cvelistv5