PT-2025-16705 · Linux+5 · Linux Kernel+5
Published
2025-04-02
·
Updated
2026-04-20
·
CVE-2025-22065
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A NULL pointer dereference issue has been identified in the Linux kernel when SRIOV is enabled. This occurs because the idpf driver is called twice, once via idpf shutdown() and again when idpf remove() calls into sriov disable(), leading to a potential NULL pointer dereference. The issue can be triggered by setting the number of virtual functions to 1 and then rebooting the system. Technical details about the issue include the
idpf remove() function and the sriov disable() function.Recommendations
Replace the direct
idpf remove() call in idpf shutdown() with idpf vc core deinit() and idpf deinit dflt mbx(), which perform the bulk of the cleanup, to avoid the calls to sriov disable() and other unnecessary cleanup tasks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu