CVE-2025-37860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37860
In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, we cannot netif_set_tso_max_size() or _segs() at this point. Move those netif calls to ef100_probe_netdev(), and also replace netif_err within the design params code with pci_err.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/8241ecec1cdc6699ae197d52d58e76bddd995fa5 Patch
https://git.kernel.org/stable/c/e56391011381d6d029da377a65ac314cb3d5def2 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

29 Apr 2025, 16:55

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/8241ecec1cdc6699ae197d52d58e76bddd995fa5 - () https://git.kernel.org/stable/c/8241ecec1cdc6699ae197d52d58e76bddd995fa5 - Patch
References () https://git.kernel.org/stable/c/e56391011381d6d029da377a65ac314cb3d5def2 - () https://git.kernel.org/stable/c/e56391011381d6d029da377a65ac314cb3d5def2 - Patch
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sfc: se corrigen las desreferencias NULL en ef100_process_design_param(). Desde el commit citada, ef100_probe_main() y, por lo tanto, también ef100_check_design_params() se ejecutan antes de crear efx->net_dev; por lo tanto, no podemos ejecutar netif_set_tso_max_size() ni _segs() en este momento. Traslade esas llamadas netif a ef100_probe_netdev() y reemplace netif_err en el código de parámetros de diseño por pci_err.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

18 Apr 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-18 07:15

Updated : 2025-04-29 16:55

NVD link : CVE-2025-37860

Mitre link : CVE-2025-37860

CVE.ORG link : CVE-2025-37860

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference