CVE-2025-39856CWE-476

CVE-2025-39856

Medium · published September 19, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev

In the TX completion packet stage of TI SoCs with CPSW2G instance, which

has single external ethernet port, ndev is accessed without being

initialized if no TX packets have been processed. It results into null

pointer dereference, causing kernel to crash. Fix this by having a check

on the number of TX packets which have been processed.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00130 · 2.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-09-19T20:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.15, < 6.16.66.16.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
https://git.kernel.org/stable/c/485302905bada953aadfe063320d73c892a66cbb · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a6099f263e1f408bcc7913c9df24b0677164fc5d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 SEP 15:26Z
    net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev
    cvelistv5