CVE-2025-38123 (GCVE-0-2025-38123)
Vulnerability from cvelistv5
Published
2025-07-03 08:35
Modified
2026-08-05 11:59
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic. BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)] ? dev_gro_receive+0x3a/0x620 napi_gro_receive+0xad/0x170 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)] t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)] net_rx_action+0x103/0x470 irq_exit_rcu+0x13a/0x310 sysvec_apic_timer_interrupt+0x56/0x90 </IRQ>
References
Impacted products
Vendor Product Version
Linux Linux Version: 5545b7b9f294de7f95ec6a7cb1de0db52296001c
Version: 5545b7b9f294de7f95ec6a7cb1de0db52296001c
Version: 5545b7b9f294de7f95ec6a7cb1de0db52296001c
Version: 5545b7b9f294de7f95ec6a7cb1de0db52296001c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wwan/t7xx/t7xx_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc89f457d9133a558d4e8ef26dc20843c2d12073",
              "status": "affected",
              "version": "5545b7b9f294de7f95ec6a7cb1de0db52296001c",
              "versionType": "git"
            },
            {
              "lessThan": "e2df04e69c3f10b412f54be036dd0ed3b14756cf",
              "status": "affected",
              "version": "5545b7b9f294de7f95ec6a7cb1de0db52296001c",
              "versionType": "git"
            },
            {
              "lessThan": "66542e9430c625f878a5b5dc0fe41e3458d614bf",
              "status": "affected",
              "version": "5545b7b9f294de7f95ec6a7cb1de0db52296001c",
              "versionType": "git"
            },
            {
              "lessThan": "905fe0845bb27e4eed2ca27ea06e6c4847f1b2b1",
              "status": "affected",
              "version": "5545b7b9f294de7f95ec6a7cb1de0db52296001c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wwan/t7xx/t7xx_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix napi rx poll issue\n\nWhen driver handles the napi rx polling requests, the netdev might\nhave been released by the dellink logic triggered by the disconnect\noperation on user plane. However, in the logic of processing skb in\npolling, an invalid netdev is still being used, which causes a panic.\n\nBUG: kernel NULL pointer dereference, address: 00000000000000f1\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:dev_gro_receive+0x3a/0x620\n[...]\nCall Trace:\n \u003cIRQ\u003e\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x4f/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]\n ? dev_gro_receive+0x3a/0x620\n napi_gro_receive+0xad/0x170\n t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]\n t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]\n net_rx_action+0x103/0x470\n irq_exit_rcu+0x13a/0x310\n sysvec_apic_timer_interrupt+0x56/0x90\n \u003c/IRQ\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The dangling `ccmni_inst[]` entry is dereferenced in the WWAN RX NAPI poll while processing IP packets received from the cellular network, and t7xx modems in laptops, IoT/industrial gateways and automotive units are directly reachable on their cellular IP, so remote downlink traffic both drives the vulnerable code and supplies the `rx_bytes` addend written through the freed pointer.\nAC:L - The stale pointer is never cleared on dellink, so the exposure is not an instruction-level window \u2014 every packet still queued in the DPMAIF PIT/BAT rings at teardown, and every packet delivered on that channel afterwards, dereferences freed memory, and a sustained downlink flood guarantees pending packets at any teardown instant.\nPR:N - No credentials on the target are needed: the netdev teardown half is performed automatically by the system\u0027s own modem manager in response to a network-initiated PDN/bearer deactivation or a modem exception, while the attacker only has to keep sending downlink traffic; even in a purely local framing the wwan netdev is not netns-local and can be deleted by an unprivileged user in a user-namespace-owned netns.\nUI:N - No victim action is required \u2014 ModemManager removes the WWAN link automatically when the user-plane session drops, and `t7xx_dpmaif_napi_rx_poll()` runs from softirq context on its own.\nS:U - The use-after-free and the resulting corruption are confined to kernel memory under the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `ccmni-\u003edev` is read out of the freed netdev allocation and then used as a `net_device` by `napi_gro_receive()`/`dev_gro_receive()`, so an attacker who grooms the reclaimed slab obtains an arbitrary-pointer read primitive and can disclose kernel memory contents.\nI:H - `net_dev-\u003estats.rx_packets++` and `net_dev-\u003estats.rx_bytes += skb_len` write through the pointer recovered from freed memory using a remote-controlled packet length, giving a use-after-free write at a chosen address that is leverageable for control-flow-relevant corruption.\nA:H - The commit documents a reproducible kernel oops \u2014 NULL/garbage pointer dereference at 0xf1 inside `dev_gro_receive()` from `t7xx_ccmni_recv_skb()` in IRQ context \u2014 and any use-after-free of this kind reliably panics the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:44.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc89f457d9133a558d4e8ef26dc20843c2d12073"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2df04e69c3f10b412f54be036dd0ed3b14756cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/66542e9430c625f878a5b5dc0fe41e3458d614bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/905fe0845bb27e4eed2ca27ea06e6c4847f1b2b1"
        }
      ],
      "title": "net: wwan: t7xx: Fix napi rx poll issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38123",
    "datePublished": "2025-07-03T08:35:29.312Z",
    "dateReserved": "2025-04-16T04:51:23.986Z",
    "dateUpdated": "2026-08-05T11:59:44.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.