{"uuid": "8a8ab7e0-1837-4a69-87c0-b3dea54cbd1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-37787", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/14456", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-37787\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered\n\nRussell King reports that a system with mv88e6xxx dereferences a NULL\npointer when unbinding this driver:\nhttps://lore.kernel.org/netdev/Z_lRkMlTJ1KQ0kVX@shell.armlinux.org.uk/\n\nThe crash seems to be in devlink_region_destroy(), which is not NULL\ntolerant but is given a NULL devlink global region pointer.\n\nAt least on some chips, some devlink regions are conditionally registered\nsince the blamed commit, see mv88e6xxx_setup_devlink_regions_global():\n\n  if (cond && !cond(chip))\n   continue;\n\nThese are MV88E6XXX_REGION_STU and MV88E6XXX_REGION_PVT. If the chip\ndoes not have an STU or PVT, it should crash like this.\n\nTo fix the issue, avoid unregistering those regions which are NULL, i.e.\nwere skipped at mv88e6xxx_setup_devlink_regions_global() time.\n\ud83d\udccf Published: 2025-05-01T13:07:21.593Z\n\ud83d\udccf Modified: 2025-05-02T06:16:26.935Z\n\ud83d\udd17 References:\n1. https://git.kernel.org/stable/c/8ccdf5e24b276848eefb2755e05ff0f005a0c4a1\n2. https://git.kernel.org/stable/c/b3c70dfe51f10df60db2646c08cebd24bcdc5247\n3. https://git.kernel.org/stable/c/bbb80f004f7a90c3dcaacc982c59967457254a05\n4. https://git.kernel.org/stable/c/3665695e3572239dc233216f06b41f40cc771889\n5. https://git.kernel.org/stable/c/5f5e95945bb1e08be7655da6acba648274db457d\n6. https://git.kernel.org/stable/c/c84f6ce918a9e6f4996597cbc62536bbf2247c96", "creation_timestamp": "2025-05-02T07:16:26.000000Z"}