Riskcovery

CVE-2025-39857

net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

State
Published
Severity
7.5 High
Published
Sep 19, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK>

If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0ef69e788411cba2af017db731a9fc62d255e9ac to before 0cdf1fd8fc59d44a48c694324611136910301ef9Affected
  • 0ef69e788411cba2af017db731a9fc62d255e9ac to before f18d9b3abf9c6587372cc702f963a7592277ed56Affected
  • 0ef69e788411cba2af017db731a9fc62d255e9ac to before eb929910bd4b4165920fa06a87b22cc6cae92e0eAffected
  • 0ef69e788411cba2af017db731a9fc62d255e9ac to before 34f17cbe027050b8d5316ea1b6f9bd7c378e92deAffected
  • 0ef69e788411cba2af017db731a9fc62d255e9ac to before ba1e9421cf1a8369d25c3832439702a015d6b5f9Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.151 through 6.1.*Not affected
  • 6.6.105 through 6.6.*Not affected
  • 6.12.46 through 6.12.*Not affected
  • 6.16.6 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.