Junglewise Threat Intelligence

CVE-2025-39857: Linux Kernel NULL pointer dereference in net/smc

CVE-2025-39857 · Severity: high · CVSS 7.5 · Published 2025-09-19

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Executive brief

A vulnerability exists in the Linux kernel's Shared Memory Communications (SMC) protocol, which is used for high-performance data exchange. When using specific software-based network acceleration (RoCE), the system may encounter a critical error and crash. This can lead to a complete denial of service, impacting the availability of applications and services relying on these network protocols.

Technical details

A NULL pointer dereference vulnerability exists in the 'smc_ib_is_sg_need_sync()' function within the 'net/smc' subsystem of the Linux kernel. The issue occurs because the code fails to validate the 'ibdev->dma_device' pointer when a software RDMA over Converged Ethernet (RoCE) device is used. An attacker or specific network conditions triggering 'smc_listen_work' can cause a kernel panic (Oops), leading to a denial of service. The fix introduces a null pointer check for 'dma_device' before it is accessed. Patches have been released for multiple stable kernel branches including 6.1.y, 6.6.y, 6.12.y, and 6.16.y.

Affected products

  • Linux Linux Kernel 6.0 to 6.1.151, 6.6.105, 6.12.46, 6.16.6
  • Siemens SIMATIC CN 4100 before V5.0

Timeline

  • 2025-08-28: patched: Initial patch authored by Liu Jian
  • 2025-09-19: disclosed: CVE published

References

Related threats