CVE-2025-22065
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-22065
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22065.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-22065
- Downstream
- Related
- Published
- 2025-04-16T14:12:19Z
- Modified
- 2025-10-10T08:55:39.868307Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- idpf: fix adapter NULL pointer dereference on reboot
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix adapter NULL pointer dereference on reboot
With SRIOV enabled, idpf ends up calling into idpfremove() twice. First via idpfshutdown() and then again when idpfremove() calls into sriovdisable(), because the VF devices use the idpf driver, hence the same remove routine. When that happens, it is possible for the adapter to be NULL from the first call to idpf_remove(), leading to a NULL pointer dereference.
echo 1 > /sys/class/net/<netif>/device/sriov_numvfs reboot
BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:idpfremove+0x22/0x1f0 [idpf] ... ? idpfremove+0x22/0x1f0 [idpf] ? idpfremove+0x1e4/0x1f0 [idpf] pcideviceremove+0x3f/0xb0 devicereleasedriverinternal+0x19f/0x200 pcistopbusdevice+0x6d/0x90 pcistopandremovebusdevice+0x12/0x20 pciiovremovevirtfn+0xbe/0x120 sriovdisable+0x34/0xe0 idpfsriovconfigure+0x58/0x140 [idpf] idpfremove+0x1b9/0x1f0 [idpf] idpfshutdown+0x12/0x30 [idpf] pcideviceshutdown+0x35/0x60 device_shutdown+0x156/0x200 ...
Replace the direct idpfremove() call in idpfshutdown() with idpfvccoredeinit() and idpfdeinitdfltmbx(), which perform the bulk of the cleanup, such as stopping the init task, freeing IRQs, destroying the vports and freeing the mailbox. This avoids the calls to sriov_disable() in addition to a small netdev cleanup, and destroying workqueues, which don't seem to be required on shutdown.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/4c9106f4906a85f6b13542d862e423bcdc118cc3
- https://git.kernel.org/stable/c/79618e952ef4dfa1a17ee0631d5549603fab58d8
- https://git.kernel.org/stable/c/88a6d562e92a295648f8636acf2a6aa714241771
- https://git.kernel.org/stable/c/9fc9b3dc0d0c189ed205acf1e5fbd73e0becc4d6
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede850efed5e152e6bdd367d5b82019f21298c0653Fixed79618e952ef4dfa1a17ee0631d5549603fab58d8
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede850efed5e152e6bdd367d5b82019f21298c0653Fixed88a6d562e92a295648f8636acf2a6aa714241771
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede850efed5e152e6bdd367d5b82019f21298c0653Fixed9fc9b3dc0d0c189ed205acf1e5fbd73e0becc4d6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede850efed5e152e6bdd367d5b82019f21298c0653Fixed4c9106f4906a85f6b13542d862e423bcdc118cc3