CVE-2025-39897

net: xilinx: axienet: Add error handling for RX metadata pointer retrieval

State: Published
Severity: 7.5 High
Published: Oct 1, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Add error handling for RX metadata pointer retrieval

Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails.

Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	6a91b846af85a24241decd686269e8e038eb13d1 to before d0ecda6fdd840b406df6617b003b036f65dd8926Affected 6a91b846af85a24241decd686269e8e038eb13d1 to before 92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196Affected 6a91b846af85a24241decd686269e8e038eb13d1 to before 8bbceba7dc5090c00105e006ce28d1292cfda8ddAffected
LinuxLinux	6.8Affected before 6.8Not affected 6.12.46 through 6.12.Not affected 6.16.6 through 6.16.Not affected 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.