Critical NULL Pointer Dereference in Linux Kernel's usbnet Package
Summary
CVE-2025-22050: In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The usbnet package specifically handles USB networking devices, enabling communication between the operating system and USB network interfaces. This package is crucial for maintaining network connectivity through USB devices, making it a vital part of many systems. However, it is susceptible to vulnerabilities that can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the usbnet package, specifically related to the handling of USB requests. The issue arises from a missing validation check in the usb_submit_urb function, which does not verify if the usbnet is in a 'going away' state. This inconsistency leads to a race condition where a URB request may succeed, but the associated SKB data fails to be queued. As a result, subsequent processes that attempt to access the SKB data can trigger a NULL pointer dereference, leading to a kernel panic and potential system crash. This vulnerability poses significant risks, particularly in environments relying on USB networking devices, as it can disrupt network services and compromise system stability.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk of exploitation.
Conclusion
The CVE-2025-22050 vulnerability in the Linux kernel's usbnet package poses a significant risk of system instability due to a NULL pointer dereference. Users are strongly encouraged to update their systems to the latest patched version of the Linux kernel to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22050 is a vulnerability in the Linux kernel's usbnet package that can lead to a NULL pointer dereference and kernel panic.
This vulnerability can cause system crashes and instability, particularly in systems using USB networking devices.
Yes, users should update their Linux kernel to the latest version that includes the patch for this vulnerability.
While there are no specific workarounds, it is crucial to apply the patch as soon as possible to avoid potential system crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
