Junglewise Threat Intelligence

CVE-2025-21848: Linux Kernel null pointer dereference in nfp_bpf_cmsg_alloc

CVE-2025-21848 · Severity: medium · CVSS 5.5 · Published 2025-03-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Netronome Flow Processor (NFP) driver could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation failures during network control message processing. This results in a system crash (kernel panic), impacting the availability of the server or workstation.

Technical details

A NULL pointer dereference exists in the Netronome Flow Processor (NFP) driver within the BPF component. The vulnerability is located in the nfp_bpf_cmsg_alloc() function in drivers/net/ethernet/netronome/nfp/bpf/cmsg.c, which failed to check the return value of nfp_app_ctrl_msg_alloc(). If memory allocation fails, the subsequent call to skb_put() dereferences a NULL pointer. A local attacker with sufficient privileges to trigger BPF map operations on NFP hardware could exploit this to cause a kernel panic (Denial of Service). The issue has been resolved by adding the necessary NULL check in the allocation path.

Affected products

  • Linux Linux Kernel 4.16 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, 6.13 to 6.13.5, 6.14-rc1 to 6.14-rc3

Timeline

  • 2025-03-12: disclosed
  • 2025-03-12: advisory
  • 2025-03-07: patched

References

Related threats