Critical NULL Pointer Dereference in Linux Kernel - CVE-2025-39857
Summary
CVE-2025-39857: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops:... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the Linux kernel versions in Debian 12, 13, and 14, specifically related to the SMC (Shared Memory Communications) subsystem, which is crucial for efficient data transfer in high-performance computing environments.
Vulnerability Detail
CVE-2025-39857 is a critical vulnerability in the Linux kernel that arises from a NULL pointer dereference in the function smc_ib_is_sg_need_sync(). This issue can lead to a kernel panic, causing the system to crash unexpectedly. The vulnerability is triggered when a software RoCE (RDMA over Converged Ethernet) device is used, resulting in the ibdev->dma_device being a null pointer. This can severely impact system stability and performance, especially in environments relying on high-speed data transfers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2025-39857 is a significant vulnerability in the Linux kernel that poses risks to system stability and performance. Users are strongly advised to update their systems to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39857 is a vulnerability in the Linux kernel that can cause a NULL pointer dereference, leading to system crashes.
The vulnerability affects Linux kernel versions in Debian 12, 13, and 14.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of system instability.
The vulnerability can lead to kernel panics, causing unexpected system crashes and potentially affecting data integrity and availability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
