CVE-2025-37860

sfc: fix NULL dereferences in ef100_process_design_param()

State: Published
Severity: 5.5 Medium
Published: Apr 18, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

sfc: fix NULL dereferences in ef100_process_design_param()

Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, we cannot netif_set_tso_max_size() or _segs() at this point. Move those netif calls to ef100_probe_netdev(), and also replace netif_err within the design params code with pci_err.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	98ff4c7c8ac7f5339aac6114105395fea19f992e to before 68ce59a1fdec97d94384499d3b5bc097fca0dd5dAffected 98ff4c7c8ac7f5339aac6114105395fea19f992e to before a9703b006a475f474a571801ad3dd9b1bda35273Affected 98ff4c7c8ac7f5339aac6114105395fea19f992e to before f21623b8446735b5e2ac5f8ee69b8743177d7b19Affected 98ff4c7c8ac7f5339aac6114105395fea19f992e to before e56391011381d6d029da377a65ac314cb3d5def2Affected 98ff4c7c8ac7f5339aac6114105395fea19f992e to before 8241ecec1cdc6699ae197d52d58e76bddd995fa5Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.57 through 6.12.Not affected 6.14.2 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

98ff4c7c8ac7f5339aac6114105395fea19f992e to before 68ce59a1fdec97d94384499d3b5bc097fca0dd5dAffected
98ff4c7c8ac7f5339aac6114105395fea19f992e to before a9703b006a475f474a571801ad3dd9b1bda35273Affected
98ff4c7c8ac7f5339aac6114105395fea19f992e to before f21623b8446735b5e2ac5f8ee69b8743177d7b19Affected
98ff4c7c8ac7f5339aac6114105395fea19f992e to before e56391011381d6d029da377a65ac314cb3d5def2Affected
98ff4c7c8ac7f5339aac6114105395fea19f992e to before 8241ecec1cdc6699ae197d52d58e76bddd995fa5Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.57 through 6.12.*Not affected
6.14.2 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.