PT-2025-8867 · Linux+1 · Linux Kernel+1
Syzbot
·
Published
2025-02-27
·
Updated
2025-09-27
·
CVE-2025-21755
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been identified, related to the vsock protocol. During socket release, the
sock orphan() function is called without considering that it sets sk->sk wq to NULL. Later, if SO LINGER is enabled, this leads to a null pointer dereference in virtio transport wait close(). The issue arises because the socket is orphaned before transport release. The problem is partially reverted by a 'Fixes:' commit. A null pointer dereference in the range [0x0000000000000018-0x000000000000001f] has been detected by KASAN.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Suse