PT-2025-4357 · Linux+6 · Linux Kernel+6
Kevin Groeneveld
·
Published
2025-01-13
·
Updated
2026-03-13
·
CVE-2025-21676
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.73/6.12.10
Description
The issue is related to a null pointer dereference in the
page pool dev alloc pages() function of the Linux kernel's drivers/net/ethernet/freescale/fec main.c module. This can occur when the system is under memory pressure, and the fec enet update cbd function calls page pool dev alloc pages but does not handle the case when it returns NULL. As a result, the kernel may crash. The problem can be reproduced with some frequency when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min free kbytes to higher values seems to solve the problem for some test cases.Recommendations
To resolve the issue, update the Linux kernel to a version that includes the fix for the
page pool dev alloc pages error handling.
As a temporary workaround, consider setting /proc/sys/vm/min free kbytes to higher values to minimize the risk of the kernel crashing due to memory allocation errors.
Additionally, dropping the current packet when an allocation error occurs can help prevent the kernel from crashing.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu