CVE-2025-39857 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK> If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.
A NULL pointer dereference vulnerability has been identified in the Linux kernel's SMC (Socket Memory Copy) component, specifically within the 'smc_ib_is_sg_need_sync' function. This vulnerability occurs when the software RoCE (RDMA over Converged Ethernet) device is used, as the 'ibdev->dma_device' pointer is NULL, leading to a kernel panic. The issue has been addressed by adding a NULL pointer check to prevent the dereference.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-032379.html | siemens-SADP | |
| https://git.kernel.org/stable/c/0cdf1fd8fc59d44a48c694324611136910301ef9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/34f17cbe027050b8d5316ea1b6f9bd7c378e92de | kernel.org | Patch |
| https://git.kernel.org/stable/c/ba1e9421cf1a8369d25c3832439702a015d6b5f9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eb929910bd4b4165920fa06a87b22cc6cae92e0e | kernel.org | Patch |
| https://git.kernel.org/stable/c/f18d9b3abf9c6587372cc702f963a7592277ed56 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.0, < 6.1.151 >= 6.2, < 6.6.105 >= 6.7, < 6.12.46 >= 6.13, < 6.16.6 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Jan 20, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 19, 2025 | New CVE Received | kernel.org |