CVE-2025-21852NULL Pointer Dereference in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 98.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 12
Latest updateMay 28

Description

In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL. Commit c53795d48ee8 ("net: add rx_sk to trace_kfree_skb") added rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL. Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier validate such a prog and prevent the issue. Now we

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

NVDlinux/linux_kernel6.116.12.17+2
Debianlinux/linux_kernel< 6.12.17-1+1
CVEListV5linux/linuxc53795d48ee8f385c6a9e394651e7ee914baaebaf579afacd0a66971fc8481f30d2d377e230a8342+3
debiandebian/linux< linux 6.12.17-1 (forky)

Patches

🔴Vulnerability Details

5
OSV
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities2025-05-28
OSV
linux-aws vulnerabilities2025-05-22
OSV
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities2025-05-20
GHSA
GHSA-g33r-c4mc-9962: In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]2025-03-12
OSV
CVE-2025-21852: In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]2025-03-12

📋Vendor Advisories

5
Ubuntu
Linux kernel vulnerabilities2025-05-28
Ubuntu
Linux kernel (AWS) vulnerabilities2025-05-22
Ubuntu
Linux kernel vulnerabilities2025-05-20
Red Hat
kernel: net: Add rx_skb of kfree_skb to raw_tp_null_args[].2025-03-12
Debian
CVE-2025-21852: linux - In the Linux kernel, the following vulnerability has been resolved: net: Add rx...2025
CVE-2025-21852 — NULL Pointer Dereference in Linux | cvebase