Kernel Crash Vulnerability in Linux Package: CVE-2025-21649
Summary
CVE-2025-21649: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of devices and architectures, making it a critical component in various environments, from servers to embedded systems. The vulnerability CVE-2025-21649 affects the hns3 driver, specifically on HIP08 devices, where a failure to register PTP devices can lead to system instability.
Vulnerability Detail
CVE-2025-21649 is a vulnerability in the Linux kernel that arises when the hns3 driver attempts to set hardware timestamp information using a NULL pointer. This occurs because HIP08 devices do not register PTP devices, resulting in a NULL value for hdev->ptp. When the transmission process tries to access this NULL pointer, it leads to a kernel crash, causing system instability and potential data loss. The vulnerability can be exploited during network transmission, particularly when 1588 timestamps are involved.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users can mitigate the risk by avoiding the use of HIP08 devices until the patch is applied.
Conclusion
CVE-2025-21649 is a critical vulnerability in the Linux kernel that can lead to kernel crashes on HIP08 devices due to a NULL pointer dereference. Users are encouraged to update their systems promptly to mitigate the risks associated with this vulnerability. For real-time monitoring of open-source vulnerabilities, consider using Vulert.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21649 is a vulnerability in the Linux kernel that can cause a kernel crash when 1588 timestamps are sent on HIP08 devices due to a NULL pointer dereference.
This vulnerability can lead to system instability and crashes, particularly during network transmissions involving timestamping, which may result in data loss.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch is available. Users should update their Linux package to the latest version to ensure the vulnerability is fixed.
If you cannot update your system, it is advisable to avoid using HIP08 devices until the patch is applied to mitigate the risk of crashes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
