CVE-2025-39875 Details
Description
In the Linux kernel, the following vulnerability has been resolved: igb: Fix NULL pointer dereference in ethtool loopback test The igb driver currently causes a NULL pointer dereference when executing the ethtool loopback test. This occurs because there is no associated q_vector for the test ring when it is set up, as interrupts are typically not added to the test rings. Since commit 5ef44b3cb43b removed the napi_id assignment in __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it. Therefore, simply use 0 as the last parameter.
A NULL pointer dereference vulnerability has been identified in the Linux kernel's igb driver, specifically during the ethtool loopback test. This issue arises because the test ring is not associated with a q_vector, as interrupts are usually not applied to test rings. The vulnerability was introduced when the napi_id assignment was removed from the XDP (eXpress Data Path) receive queue registration function, creating an unnecessary requirement to pass a napi_id. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/473be7d39efd3be383e9c0c8e44b53508b4ffeb5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/75871a525a596ff4d16c4aebc0018f8d0923c9b1 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.14, < 6.16.8 6.17 rc1 6.17 rc2 6.17 rc3 6.17 rc4 6.17 rc5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Sep 23, 2025 | New CVE Received | kernel.org |