Medium severity · published Sep 19, 2025
CVE-2025-39857
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
BUG: kernel NULL pointer dereference, address: 00000000000002ec
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Workqueue: smc_hs_wq smc_listen_work [smc]
RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc]
...
Call Trace:
<TASK>
smcr_buf_map_link+0x211/0x2a0 [smc]
__smc_buf_create+0x522/0x970 [smc]
smc_buf_create+0x3a/0x110 [smc]
smc_find_rdma_v2_device_serv+0x18f/0x240 [smc]
? smc_vlan_by_tcpsk+0x7e/0xe0 [smc]
smc_listen_find_device+0x1dd/0x2b0 [smc]
smc_listen_work+0x30f/0x580 [smc]
process_one_work+0x18c/0x340
worker_thread+0x242/0x360
kthread+0xe7/0x220
ret_from_fork+0x13a/0x160
ret_from_fork_asm+0x1a/0x30
</TASK>
If the software RoCE device is used, ibdev->dma_device is a null pointer.
As a result, the problem occurs. Null pointer detection is added to
prevent problems.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
6.0 before 6.1.151; 6.2 before 6.6.105; 6.7 before 6.12.46; 6.13 before 6.16.6; 6.17; 6.17; +2 more · source: NVD
LI
Linux · Linux
0ef69e788411cba2af017db731a9fc62d255e9ac before 0cdf1fd8fc59d44a48c694324611136910301ef9; 0ef69e788411cba2af017db731a9fc62d255e9ac before f18d9b3abf9c6587372cc702f963a7592277ed56; 0ef69e788411cba2af017db731a9fc62d255e9ac before eb929910bd4b4165920fa06a87b22cc6cae92e0e; 0ef69e788411cba2af017db731a9fc62d255e9ac before 34f17cbe027050b8d5316ea1b6f9bd7c378e92de; 0ef69e788411cba2af017db731a9fc62d255e9ac before ba1e9421cf1a8369d25c3832439702a015d6b5f9; 6.0 · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
SC
SIMATIC CN 4100 · Siemens
before V5.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-39857
Patch
https://git.kernel.org/stable/c/0cdf1fd8fc59d44a48c694324611136910301ef9
Patch
https://git.kernel.org/stable/c/34f17cbe027050b8d5316ea1b6f9bd7c378e92de
Patch
https://git.kernel.org/stable/c/ba1e9421cf1a8369d25c3832439702a015d6b5f9
Patch
https://git.kernel.org/stable/c/eb929910bd4b4165920fa06a87b22cc6cae92e0e
Patch
https://git.kernel.org/stable/c/f18d9b3abf9c6587372cc702f963a7592277ed56
Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability