Critical Crash Vulnerability in Linux Kernel (CVE-2025-21723)
Summary
CVE-2025-21723: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services for applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the SCSI (Small Computer System Interface) subsystem, particularly the mpi3mr driver, which manages storage devices.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-21723 has been discovered in the mpi3mr driver. This issue arises when the function bsg_setup_queue() fails, leading to the assignment of a non-NULL value to the bsg_queue. Consequently, during the cleanup process in mpi3mr_bsg_exit(), the condition checking for a NULL bsg_queue fails, preventing the execution of bsg_remove_queue(). This oversight can trigger a kernel NULL pointer dereference, resulting in a crash and potential system instability. The crash is indicated by the error message: 'BUG: kernel NULL pointer dereference, address: 000000000000041c'.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the kernel updates as soon as they are available.
Conclusion
CVE-2025-21723 is a critical vulnerability in the Linux kernel that can lead to system crashes. It is essential for users to stay informed about updates and apply patches promptly to ensure system stability and security. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21723 is a vulnerability in the Linux kernel's mpi3mr driver that can lead to a system crash due to a NULL pointer dereference.
If exploited, this vulnerability can cause your system to crash, leading to potential data loss and service interruptions.
You should update your Linux kernel to the latest patched version as soon as it becomes available to mitigate the risk.
As of now, there are no publicly known exploits for CVE-2025-21723, but it is crucial to apply updates to prevent potential exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
