Kernel NULL Pointer Dereference Vulnerability in Linux Package
Summary
CVE-2025-21980: In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED scheduler. Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's scheduler, which manages process scheduling, is crucial for system performance. This vulnerability specifically affects the GRED (Generic Random Early Detection) scheduler, which is designed to manage network traffic and prevent congestion. The vulnerability arises from improper error handling, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the GRED scheduler where a NULL pointer dereference could occur. This issue arises when the kzalloc function in gred_init returns a NULL pointer. The subsequent error handling path invokes gred_destroy, which calls gred_offload. If gred_offload receives a NULL pointer, it can lead to a kernel crash due to an invalid memory access. This vulnerability can compromise system stability and reliability, particularly in environments relying on the GRED scheduler for network traffic management.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to monitor for updates and apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21980 vulnerability in the Linux kernel's GRED scheduler poses a significant risk of system crashes due to NULL pointer dereference. Users are advised to update their systems to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21980 is a vulnerability in the Linux kernel's GRED scheduler that can lead to a NULL pointer dereference and potential kernel crash.
This vulnerability can cause instability in systems using the GRED scheduler, potentially leading to crashes and affecting overall performance.
Yes, a patch is available for Debian 13 in version 6.12.20-1 or later. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patch as soon as possible to mitigate risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
