NULL Pointer Dereference Vulnerability in Linux Kernel - CVE-2025-37949
Summary
CVE-2025-37949: In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference,... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various distributions, including Debian. This vulnerability affects the xenbus component, which is responsible for communication between the Xen hypervisor and guest domains. The issue arises from improper management of request lifetimes, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, specifically within the xenbus component, a NULL pointer dereference vulnerability has been identified. This issue occurs when the xenbus_thread attempts to access a request that has already been freed, resulting in a crash. The vulnerability was reported by Marek, who observed a NULL pointer fault in the call stack, indicating that the request was prematurely deallocated. This can lead to system instability and potential denial of service, as the kernel may attempt to access invalid memory addresses.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37949 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper handling of request lifetimes. Users are urged to update their systems to the latest patched version to mitigate this risk. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37949 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference, causing system crashes.
This vulnerability can lead to instability and potential denial of service, as it may cause the kernel to access invalid memory.
The vulnerability affects all versions of the Linux kernel in Debian 11, 12, and 13. It is advisable to check for updates.
The best protection is to update your Linux kernel to the latest patched version as soon as it is available.
Vulert monitors open-source vulnerabilities in software using a manifest file. You can check if your application is affected by CVE-2025-37949 using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
