Critical NULL Dereference Vulnerability in Linux Kernel - CVE-2025-21857
Summary
DEBIAN-CVE-2025-21857: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allo... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and security features. However, like any complex software, it can be susceptible to vulnerabilities. This specific issue affects the Linux package in Debian versions 13 and 14, highlighting a flaw in the network scheduling component that can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the network scheduling component (net/sched). The function tcf_exts_miss_cookie_base_alloc() may return a value of 1 upon successful allocation after wrapping, which is incorrectly treated as an error. This leads to a NULL pointer dereference when the actions are dereferenced in the tcf_action_init() function, potentially causing system instability and crashes. The vulnerability can be exploited, leading to a kernel panic and denial of service.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21857 vulnerability in the Linux kernel poses a significant risk to systems running affected Debian versions. It is essential to apply the patch as soon as possible to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21857 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference, potentially causing system crashes.
Debian versions 13 and 14 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds available, it is crucial to prioritize updating your package to mitigate the risk of exploitation.
Exploitation of this vulnerability can lead to kernel panics, system crashes, and denial of service, affecting the stability and reliability of your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
