CVE-2025-21980NULL Pointer Dereference in Linux

Severity
5.5MEDIUMNVD
OSV5.9OSV4.7
EPSS
0.1%
top 76.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 1
Latest updateOct 15

Description

In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED scheduler. If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. This, in turn, calls gred_offload, where memset could receive a NULL pointer as input, potentially leading to a kernel crash. When table->opt is NULL in gred_init(), gred_change_table_def() is not called yet, so it is not necessary to call -

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages8 packages

Patches

🔴Vulnerability Details

20
OSV
linux-oracle-6.8 vulnerabilities2025-10-15
OSV
linux-azure-nvidia vulnerabilities2025-10-08
OSV
linux-oracle vulnerabilities2025-10-06
OSV
linux-azure, linux-azure-6.8 vulnerabilities2025-10-02
OSV
linux-raspi-realtime vulnerabilities2025-10-02

📋Vendor Advisories

21
Ubuntu
Linux kernel (Oracle) vulnerabilities2025-10-15
Ubuntu
Linux kernel (Azure, N-Series) vulnerabilities2025-10-08
Ubuntu
Linux kernel (Oracle) vulnerabilities2025-10-06
Ubuntu
Linux kernel (Raspberry Pi Real-time) vulnerabilities2025-10-02
Ubuntu
Linux kernel (HWE) vulnerabilities2025-10-02
CVE-2025-21980 — NULL Pointer Dereference in Linux | cvebase