Kernel Crash Vulnerability in Linux Package: CVE-2025-21649
Summary
DEBIAN-CVE-2025-21649: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. Affects linux versions < 6.12.10-1. Fixed in 6.12.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise, impacting system reliability and security. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, particularly concerning the handling of Precision Time Protocol (PTP) on HIP08 devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the hns3 driver fails to properly handle the transmission of PTP packets on HIP08 devices. When a PTP packet is sent, the driver attempts to access a NULL pointer due to the absence of registered PTP devices, leading to a kernel crash. This can result in system instability and potential data loss, as the kernel cannot handle the NULL pointer dereference, causing a crash and requiring a system reboot.
How To Fix
Minimum fixed version
6.12.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21649 vulnerability in the Linux kernel poses a significant risk by potentially causing kernel crashes on HIP08 devices. Users are advised to update their systems to the patched version to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21649 is a vulnerability in the Linux kernel that can cause a kernel crash when PTP packets are sent on HIP08 devices.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.10-1.
You can use the Vulert platform to check if your application is affected by this vulnerability without needing to install any software.
The risks include system crashes, potential data loss, and overall instability of the operating system.
The best protection is to update your Linux kernel to the patched version as soon as it is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
