Critical NULL Dereference Vulnerability in Linux Kernel Packages
Summary
CVE-2025-37860: In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It is widely used across various distributions, including Debian. This vulnerability affects the Linux kernel packages in Debian 12 and 13, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a critical NULL dereference vulnerability has been identified in the ef100_process_design_param() function. This issue arises because the ef100_probe_main() function executes before the efx->net_dev is created, preventing the netif_set_tso_max_size() and _segs() functions from being called appropriately. As a result, this can lead to system crashes or unexpected behavior, posing significant risks to system integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
The CVE-2025-37860 vulnerability in the Linux kernel poses a significant risk to system stability and security. It is crucial for users of Debian 12 and 13 to update their kernel packages promptly to avoid potential issues. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37860 is a vulnerability in the Linux kernel that can lead to NULL dereferences, potentially causing system crashes.
The vulnerability affects the Linux kernel packages in Debian 12 and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential system crashes and unexpected behavior, which can compromise system stability and security.
Yes, users are advised to update their Linux kernel packages to the latest version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
