CVE-2025-39814

published 2025-09-16

CVE-2025-39814: In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when the…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset

Issuing a reset when the driver is loaded without RDMA support, will
results in a crash as it attempts to remove RDMA's non-existent auxbus
device:
echo 1 > /sys/class/net//device/reset

BUG: kernel NULL pointer dereference, address: 0000000000000008
...
RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice]
...
Call Trace:

ice_prepare_for_reset+0x77/0x260 [ice]
pci_dev_save_and_disable+0x2c/0x70
pci_reset_function+0x88/0x130
reset_store+0x5a/0xa0
kernfs_fop_write_iter+0x15e/0x210
vfs_write+0x273/0x520
ksys_write+0x6b/0xe0
do_syscall_64+0x79/0x3b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e

ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but
pf->cdev_info will also be NULL, leading to the deref in the trace above.

Introduce a flag to be set when the creation of the auxbus device is
successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev().

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.16.5-1 (forky)	linux 6.16.5-1 (forky)
linux	linux	—	—
linux	linux	>= c24a65b6a27c78d8540409800886b6622ea86ebf < db783756a7d7cfaea039411971d0dc0a374e85cb	db783756a7d7cfaea039411971d0dc0a374e85cb
linux	linux	>= c24a65b6a27c78d8540409800886b6622ea86ebf < 60dfe2434eed13082f26eb7409665dfafb38fa51	60dfe2434eed13082f26eb7409665dfafb38fa51
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.16.5-1	6.16.5-1
linux	linux_kernel	>= 6.16 < 6.16.5	6.16.5

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 LOW

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476