CVE-2025-39897 (GCVE-0-2025-39897)
Vulnerability from cvelistv5
Published
2025-10-01 07:42
Modified
2026-08-05 12:05
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails. Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6a91b846af85a24241decd686269e8e038eb13d1
Version: 6a91b846af85a24241decd686269e8e038eb13d1
Version: 6a91b846af85a24241decd686269e8e038eb13d1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:28:46.346333Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:13.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0ecda6fdd840b406df6617b003b036f65dd8926",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            },
            {
              "lessThan": "8bbceba7dc5090c00105e006ce28d1292cfda8dd",
              "status": "affected",
              "version": "6a91b846af85a24241decd686269e8e038eb13d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Add error handling for RX metadata pointer retrieval\n\nAdd proper error checking for dmaengine_desc_get_metadata_ptr() which\ncan return an error pointer and lead to potential crashes or undefined\nbehaviour if the pointer retrieval fails.\n\nProperly handle the error by unmapping DMA buffer, freeing the skb and\nreturning early to prevent further processing with invalid data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the RX completion callback of the Xilinx AXI Ethernet driver, reached purely by receiving a frame on the NIC, with no local access required. Any remote host able to send traffic that reaches the interface \u2014 including routed internet traffic to these FPGA-based embedded/industrial network devices \u2014 drives the faulting path.\nAC:L - In the affected configuration the error pointer is returned on every RX completion, so the very first packet the attacker sends deterministically triggers the fault \u2014 no race, no memory-layout grooming, no timing window. The attacker needs only to cause a single frame to arrive.\nPR:N - The RX DMA callback runs on unauthenticated inbound frames long before any protocol, socket, or credential check; the packet is not even parsed yet. No account, capability, or namespace access on the target is needed.\nUI:N - Packet reception and DMA completion processing are fully automatic within the driver\u0027s interrupt/tasklet path. No local user has to open, mount, configure, or interact with anything.\nS:U - The fault occurs in kernel code and its consequences are confined to the same kernel security authority \u2014 there is no hypervisor, IOMMU, or sandbox boundary crossed. This is a standard in-kernel driver defect.\nC:N - The dereference targets an ERR_PTR value in the permanently unmapped top page of the address space, so the load faults immediately and returns no data to the attacker. Execution never reaches the subsequent skb_put()/__netif_rx() that could have exposed adjacent heap contents, and the pointer value is fixed by driver state rather than attacker-controlled, so no read primitive exists.\nI:N - The bug is a single invalid read; there is no out-of-bounds write, no freed-object reuse, and no type confusion, so no kernel memory is modified. The faulting access aborts before any state-changing operation on the skb or the DMA ring.\nA:H - Dereferencing the error pointer causes a kernel oops from axienet_dma_rx_cb(), which executes in the dmaengine tasklet (softirq) context \u2014 a fatal exception in interrupt context that panics the machine. On affected systems this is a remotely triggerable, repeatable full denial of service of a network device that is often the only link to an embedded or industrial controller."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:58.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0ecda6fdd840b406df6617b003b036f65dd8926"
        },
        {
          "url": "https://git.kernel.org/stable/c/92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bbceba7dc5090c00105e006ce28d1292cfda8dd"
        }
      ],
      "title": "net: xilinx: axienet: Add error handling for RX metadata pointer retrieval",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39897",
    "datePublished": "2025-10-01T07:42:45.593Z",
    "dateReserved": "2025-04-16T07:20:57.146Z",
    "dateUpdated": "2026-08-05T12:05:58.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39897\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:28:46.346333Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:28:41.036Z\"}}], \"cna\": {\"title\": \"net: xilinx: axienet: Add error handling for RX metadata pointer retrieval\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is the RX completion callback of the Xilinx AXI Ethernet driver, reached purely by receiving a frame on the NIC, with no local access required. Any remote host able to send traffic that reaches the interface \\u2014 including routed internet traffic to these FPGA-based embedded/industrial network devices \\u2014 drives the faulting path.\\nAC:L - In the affected configuration the error pointer is returned on every RX completion, so the very first packet the attacker sends deterministically triggers the fault \\u2014 no race, no memory-layout grooming, no timing window. The attacker needs only to cause a single frame to arrive.\\nPR:N - The RX DMA callback runs on unauthenticated inbound frames long before any protocol, socket, or credential check; the packet is not even parsed yet. No account, capability, or namespace access on the target is needed.\\nUI:N - Packet reception and DMA completion processing are fully automatic within the driver\u0027s interrupt/tasklet path. No local user has to open, mount, configure, or interact with anything.\\nS:U - The fault occurs in kernel code and its consequences are confined to the same kernel security authority \\u2014 there is no hypervisor, IOMMU, or sandbox boundary crossed. This is a standard in-kernel driver defect.\\nC:N - The dereference targets an ERR_PTR value in the permanently unmapped top page of the address space, so the load faults immediately and returns no data to the attacker. Execution never reaches the subsequent skb_put()/__netif_rx() that could have exposed adjacent heap contents, and the pointer value is fixed by driver state rather than attacker-controlled, so no read primitive exists.\\nI:N - The bug is a single invalid read; there is no out-of-bounds write, no freed-object reuse, and no type confusion, so no kernel memory is modified. The faulting access aborts before any state-changing operation on the skb or the DMA ring.\\nA:H - Dereferencing the error pointer causes a kernel oops from axienet_dma_rx_cb(), which executes in the dmaengine tasklet (softirq) context \\u2014 a fatal exception in interrupt context that panics the machine. On affected systems this is a remotely triggerable, repeatable full denial of service of a network device that is often the only link to an embedded or industrial controller.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6a91b846af85a24241decd686269e8e038eb13d1\", \"lessThan\": \"d0ecda6fdd840b406df6617b003b036f65dd8926\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a91b846af85a24241decd686269e8e038eb13d1\", \"lessThan\": \"92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a91b846af85a24241decd686269e8e038eb13d1\", \"lessThan\": \"8bbceba7dc5090c00105e006ce28d1292cfda8dd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/xilinx/xilinx_axienet_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/xilinx/xilinx_axienet_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d0ecda6fdd840b406df6617b003b036f65dd8926\"}, {\"url\": \"https://git.kernel.org/stable/c/92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196\"}, {\"url\": \"https://git.kernel.org/stable/c/8bbceba7dc5090c00105e006ce28d1292cfda8dd\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: xilinx: axienet: Add error handling for RX metadata pointer retrieval\\n\\nAdd proper error checking for dmaengine_desc_get_metadata_ptr() which\\ncan return an error pointer and lead to potential crashes or undefined\\nbehaviour if the pointer retrieval fails.\\n\\nProperly handle the error by unmapping DMA buffer, freeing the skb and\\nreturning early to prevent further processing with invalid data.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.46\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.6\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:05:58.614Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39897\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:05:58.614Z\", \"dateReserved\": \"2025-04-16T07:20:57.146Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-01T07:42:45.593Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.