CVE-2025-21848

nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

State: Published
Severity: 5.5 Medium
Published: Mar 12, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	ff3d43f7568c82b335d7df2d40a31447c3fce10c to before d64c6ca420019712e194fe095b55f87363e22a9aAffected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before e976ea6c5e1b005c64467cbf94a8577aae9c7d81Affected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 924b239f9704566e0d86abd894d2d64bd73c11ebAffected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 1358d8e07afdf21d49ca6f00c56048442977e00aAffected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 29ccb1e4040da6ff02b7e64efaa2f8e6bf06020dAffected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 897c32cd763fd11d0b6ed024c52f44d2475bb820Affected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before bd97f60750bb581f07051f98e31dfda59d3a783bAffected ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 878e7b11736e062514e58f3b445ff343e6705537Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.130 through 6.1.Not affected 6.6.80 through 6.6.Not affected 6.12.17 through 6.12.Not affected 6.13.5 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

ff3d43f7568c82b335d7df2d40a31447c3fce10c to before d64c6ca420019712e194fe095b55f87363e22a9aAffected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before e976ea6c5e1b005c64467cbf94a8577aae9c7d81Affected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 924b239f9704566e0d86abd894d2d64bd73c11ebAffected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 1358d8e07afdf21d49ca6f00c56048442977e00aAffected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 29ccb1e4040da6ff02b7e64efaa2f8e6bf06020dAffected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 897c32cd763fd11d0b6ed024c52f44d2475bb820Affected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before bd97f60750bb581f07051f98e31dfda59d3a783bAffected
ff3d43f7568c82b335d7df2d40a31447c3fce10c to before 878e7b11736e062514e58f3b445ff343e6705537Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.130 through 6.1.*Not affected
6.6.80 through 6.6.*Not affected
6.12.17 through 6.12.*Not affected
6.13.5 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.