FKIE_CVE-2025-68213

Vulnerability from fkie_nvd - Published: 2025-12-16 14:15 - Updated: 2026-10-14 13:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: idpf: fix possible vport_config NULL pointer deref in remove Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF: [ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] <TASK> [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0 Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/118082368c2b6ddefe6cb607efc312285148f044
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a0e1c9bc1c9fe735978150ad075616a728073bc7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d5be8663cff0ba7b94da34ebd499ce1123b4c334
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0e1c9bc1c9fe735978150ad075616a728073bc7",
              "status": "affected",
              "version": "bd80fbf3ed250ca98923780dab5e634db5d2f828",
              "versionType": "git"
            },
            {
              "lessThan": "d5be8663cff0ba7b94da34ebd499ce1123b4c334",
              "status": "affected",
              "version": "e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179",
              "versionType": "git"
            },
            {
              "lessThan": "118082368c2b6ddefe6cb607efc312285148f044",
              "status": "affected",
              "version": "e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e87b3145578a169839e456fa0aba86e123d2d8e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ba11b0f3e9a97661f6caeee3dfc633af8ecee5a5",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.60",
              "status": "affected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix possible vport_config NULL pointer deref in remove\n\nAttempting to remove the driver will cause a crash in cases where\nthe vport failed to initialize. Following trace is from an instance where\nthe driver failed during an attempt to create a VF:\n[ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated\n[ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms)\n[ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028\n...\n[ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf]\n...\n[ 1723.364973] Call Trace:\n[ 1723.365475]  \u003cTASK\u003e\n[ 1723.365972]  pci_device_remove+0x42/0xb0\n[ 1723.366481]  device_release_driver_internal+0x1a9/0x210\n[ 1723.366987]  pci_stop_bus_device+0x6d/0x90\n[ 1723.367488]  pci_stop_and_remove_bus_device+0x12/0x20\n[ 1723.367971]  pci_iov_remove_virtfn+0xbd/0x120\n[ 1723.368309]  sriov_disable+0x34/0xe0\n[ 1723.368643]  idpf_sriov_configure+0x58/0x140 [idpf]\n[ 1723.368982]  sriov_numvfs_store+0xda/0x1c0\n\nAvoid the NULL pointer dereference by adding NULL pointer check for\nvport_config[i], before freeing user_config.q_coalesce."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: soluciona posible desreferencia de puntero NULL de vport_config en la eliminaci\u00f3n\n\nIntentar eliminar el controlador causar\u00e1 un fallo en casos donde el vport no pudo inicializarse. El siguiente rastro es de una instancia donde el controlador fall\u00f3 durante un intento de crear un VF:\n[ 1661.543624] idpf 0000:84:00.7: Reinicio de HW del dispositivo iniciado\n[ 1722.923726] idpf 0000:84:00.7: Transacci\u00f3n agot\u00f3 el tiempo de espera (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms)\n[ 1723.353263] BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000028\n...\n[ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf]\n...\n[ 1723.364973] Call Trace:\n[ 1723.365475]  \u003cTASK\u003e\n[ 1723.365972]  pci_device_remove+0x42/0xb0\n[ 1723.366481]  device_release_driver_internal+0x1a9/0x210\n[ 1723.366987]  pci_stop_bus_device+0x6d/0x90\n[ 1723.367488]  pci_stop_and_remove_bus_device+0x12/0x20\n[ 1723.367971]  pci_iov_remove_virtfn+0xbd/0x120\n[ 1723.368309]  sriov_disable+0x34/0xe0\n[ 1723.368643]  idpf_sriov_configure+0x58/0x140 [idpf]\n[ 1723.368982]  sriov_numvfs_store+0xda/0x1c0\n\nEvitar la desreferencia de puntero NULL a\u00f1adiendo una comprobaci\u00f3n de puntero NULL para vport_config[i], antes de liberar user_config.q_coalesce."
    }
  ],
  "id": "CVE-2025-68213",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {},
  "published": "2025-12-16T14:15:54.247",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/118082368c2b6ddefe6cb607efc312285148f044"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a0e1c9bc1c9fe735978150ad075616a728073bc7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d5be8663cff0ba7b94da34ebd499ce1123b4c334"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.