Null Pointer Dereference in Linux Kernel's mv88e6xxx Driver
Summary
CVE-2025-37787: In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered Russell King reports that a system with mv88e6xxx dereferences a NU... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux-based operating systems, managing hardware and system resources. The mv88e6xxx driver is responsible for handling specific Ethernet switch chips, enabling communication between network devices. This driver is crucial for systems utilizing these chips, ensuring efficient data transfer and network management. However, it has been found vulnerable to a null pointer dereference issue, which can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the mv88e6xxx driver where a null pointer dereference occurs during the unbinding process. This issue arises when the driver attempts to unregister devlink regions that were never registered, leading to a crash in the devlink_region_destroy() function. The vulnerability is particularly problematic for systems with certain chips that conditionally register devlink regions, resulting in a potential system failure if the chip lacks specific regions.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to avoid potential system crashes.
Conclusion
The CVE-2025-37787 vulnerability in the Linux kernel's mv88e6xxx driver poses a significant risk of system crashes due to null pointer dereference. It is essential to update to the patched version to mitigate this risk. Users should remain vigilant and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37787 is a vulnerability in the Linux kernel's mv88e6xxx driver that can cause a system crash due to a null pointer dereference.
If your system uses the mv88e6xxx driver and lacks certain devlink regions, it may crash when the driver is unbound, leading to potential downtime.
Yes, a patch is available in the Linux package version 6.1.135-1 for Debian 12. Ensure to update your system to this version or later.
While there are no specific workarounds, it is crucial to monitor your system for crashes and plan to apply the patch as soon as possible.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time without needing to access the code.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
