Critical NULL Pointer Dereference in Linux Kernel 9p Filesystem
Summary
CVE-2025-22070: In the Linux kernel, the following vulnerability has been resolved: fs/9p: fix NULL pointer dereference on mkdir When a 9p tree was mounted with option 'posixacl', parent directory had a default ACL set for its subdirect... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and file systems. The 9p filesystem is a network file system that allows for file sharing between different systems. This vulnerability affects the 9p filesystem when used with the 'posixacl' option, which can lead to crashes when creating subdirectories under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the 9p filesystem that leads to a NULL pointer dereference when attempting to create a subdirectory in a parent directory with a default ACL set. This issue arises from the order of function calls in the code, specifically in the v9fs_vfs_mkdir_dotl() function. When a 9p tree is mounted with the 'posixacl' option, and the parent directory has a default ACL set, the v9fs_fid_add() function sets the 'fid' pointer to NULL, which is then used in a subsequent call to v9fs_set_create_acl(). This results in a kernel crash, as the system attempts to dereference a NULL pointer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'posixacl' option when mounting 9p filesystems or refrain from setting default ACLs on parent directories until the kernel is updated.
Conclusion
The vulnerability CVE-2025-22070 in the Linux kernel's 9p filesystem poses a significant risk by causing system crashes under specific conditions. Users are advised to update their kernel to the patched version and consider workarounds until the update is applied. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22070 is a vulnerability in the Linux kernel's 9p filesystem that can cause a NULL pointer dereference, leading to system crashes when creating subdirectories under certain conditions.
If your system uses the 9p filesystem with the 'posixacl' option and has default ACLs set on parent directories, it may crash when attempting to create subdirectories.
You should update your Linux kernel to the latest patched version that addresses CVE-2025-22070. Check your package manager for available updates.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Vulert is a tool that monitors open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
