CVE-2025-22006 (GCVE-0-2025-22006)

Vulnerability from cvelistv5 – Published: 2025-04-03 07:19 – Updated: 2026-05-11 21:10
VLAI
Title
net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence Registering the interrupts for TX or RX DMA Channels prior to registering their respective NAPI callbacks can result in a NULL pointer dereference. This is seen in practice as a random occurrence since it depends on the randomness associated with the generation of traffic by Linux and the reception of traffic from the wire.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 82b44cdb0355b5061769ae51909d1c8a1b7f31f2 , < d4bf956547c38c04fad8d72a961ac4dc00bad000 (git)
Affected: faef4c2bebac3c6e4161e66c3d42b85e88013709 , < 942557abed7f38b77a47d77b92d448802eefe185 (git)
Affected: 681eb2beb3efe21e630bcc4881595e3b42dd7948 , < 5f079290e5913a0060e059500b7d440990ac1066 (git)
Create a notification for this product.
Linux Linux Affected: 6.12.14 , < 6.12.21 (semver)
Affected: 6.13.3 , < 6.13.9 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:09:29.493239Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:09:33.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4bf956547c38c04fad8d72a961ac4dc00bad000",
              "status": "affected",
              "version": "82b44cdb0355b5061769ae51909d1c8a1b7f31f2",
              "versionType": "git"
            },
            {
              "lessThan": "942557abed7f38b77a47d77b92d448802eefe185",
              "status": "affected",
              "version": "faef4c2bebac3c6e4161e66c3d42b85e88013709",
              "versionType": "git"
            },
            {
              "lessThan": "5f079290e5913a0060e059500b7d440990ac1066",
              "status": "affected",
              "version": "681eb2beb3efe21e630bcc4881595e3b42dd7948",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.21",
              "status": "affected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13.9",
              "status": "affected",
              "version": "6.13.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.21",
                  "versionStartIncluding": "6.12.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.9",
                  "versionStartIncluding": "6.13.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\n\nRegistering the interrupts for TX or RX DMA Channels prior to registering\ntheir respective NAPI callbacks can result in a NULL pointer dereference.\nThis is seen in practice as a random occurrence since it depends on the\nrandomness associated with the generation of traffic by Linux and the\nreception of traffic from the wire."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:10:49.587Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000"
        },
        {
          "url": "https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066"
        }
      ],
      "title": "net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22006",
    "datePublished": "2025-04-03T07:19:07.407Z",
    "dateReserved": "2024-12-29T08:45:45.803Z",
    "dateUpdated": "2026-05-11T21:10:49.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22006",
      "date": "2026-07-21",
      "epss": "0.00174",
      "percentile": "0.07096"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22006\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-03T08:15:16.220\",\"lastModified\":\"2026-06-17T08:44:49.717\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\\n\\nRegistering the interrupts for TX or RX DMA Channels prior to registering\\ntheir respective NAPI callbacks can result in a NULL pointer dereference.\\nThis is seen in practice as a random occurrence since it depends on the\\nrandomness associated with the generation of traffic by Linux and the\\nreception of traffic from the wire.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethernet: ti: am65-cpsw: Se ha corregido la secuencia de registro de NAPI. Registrar las interrupciones para los canales DMA TX o RX antes de registrar sus respectivas devoluciones de llamada NAPI puede provocar una desreferencia de puntero nulo. En la pr\u00e1ctica, esto se considera un evento aleatorio, ya que depende de la aleatoriedad asociada con la generaci\u00f3n de tr\u00e1fico por parte de Linux y la recepci\u00f3n de tr\u00e1fico desde la red.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"82b44cdb0355b5061769ae51909d1c8a1b7f31f2\",\"lessThan\":\"d4bf956547c38c04fad8d72a961ac4dc00bad000\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faef4c2bebac3c6e4161e66c3d42b85e88013709\",\"lessThan\":\"942557abed7f38b77a47d77b92d448802eefe185\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"681eb2beb3efe21e630bcc4881595e3b42dd7948\",\"lessThan\":\"5f079290e5913a0060e059500b7d440990ac1066\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12.14\",\"lessThan\":\"6.12.21\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.3\",\"lessThan\":\"6.13.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T17:09:29.493239Z\",\"id\":\"CVE-2025-22006\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.14\",\"versionEndExcluding\":\"6.12.21\",\"matchCriteriaId\":\"FADA53DA-6264-4159-8634-545524F7A021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.3\",\"versionEndExcluding\":\"6.13.9\",\"matchCriteriaId\":\"121A3D36-97F4-4EFC-AC81-4051E74494FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:43:42+00:00",
      "cve": "CVE-2025-22006",
      "id": "CVE-2025-22006",
      "initial_release_date": "2025-04-03T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22006.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-22006\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:09:29.493239Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:39:41.116Z\"}}], \"cna\": {\"title\": \"net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"82b44cdb0355b5061769ae51909d1c8a1b7f31f2\", \"lessThan\": \"d4bf956547c38c04fad8d72a961ac4dc00bad000\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"faef4c2bebac3c6e4161e66c3d42b85e88013709\", \"lessThan\": \"942557abed7f38b77a47d77b92d448802eefe185\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"681eb2beb3efe21e630bcc4881595e3b42dd7948\", \"lessThan\": \"5f079290e5913a0060e059500b7d440990ac1066\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12.14\", \"lessThan\": \"6.12.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.13.3\", \"lessThan\": \"6.13.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000\"}, {\"url\": \"https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185\"}, {\"url\": \"https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\\n\\nRegistering the interrupts for TX or RX DMA Channels prior to registering\\ntheir respective NAPI callbacks can result in a NULL pointer dereference.\\nThis is seen in practice as a random occurrence since it depends on the\\nrandomness associated with the generation of traffic by Linux and the\\nreception of traffic from the wire.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.21\", \"versionStartIncluding\": \"6.12.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.9\", \"versionStartIncluding\": \"6.13.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:10:49.587Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-22006\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T21:10:49.587Z\", \"dateReserved\": \"2024-12-29T08:45:45.803Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-03T07:19:07.407Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.