Vulnerability-Lookup

GHSA-8284-3J42-5WJ5

Vulnerability from github – Published: 2025-12-16 15:30 – Updated: 2025-12-16 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix possible vport_config NULL pointer deref in remove

Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF: [ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0

Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-68213"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T14:15:54Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix possible vport_config NULL pointer deref in remove\n\nAttempting to remove the driver will cause a crash in cases where\nthe vport failed to initialize. Following trace is from an instance where\nthe driver failed during an attempt to create a VF:\n[ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated\n[ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms)\n[ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028\n...\n[ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf]\n...\n[ 1723.364973] Call Trace:\n[ 1723.365475]  \u003cTASK\u003e\n[ 1723.365972]  pci_device_remove+0x42/0xb0\n[ 1723.366481]  device_release_driver_internal+0x1a9/0x210\n[ 1723.366987]  pci_stop_bus_device+0x6d/0x90\n[ 1723.367488]  pci_stop_and_remove_bus_device+0x12/0x20\n[ 1723.367971]  pci_iov_remove_virtfn+0xbd/0x120\n[ 1723.368309]  sriov_disable+0x34/0xe0\n[ 1723.368643]  idpf_sriov_configure+0x58/0x140 [idpf]\n[ 1723.368982]  sriov_numvfs_store+0xda/0x1c0\n\nAvoid the NULL pointer dereference by adding NULL pointer check for\nvport_config[i], before freeing user_config.q_coalesce.",
  "id": "GHSA-8284-3j42-5wj5",
  "modified": "2025-12-16T15:30:46Z",
  "published": "2025-12-16T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68213"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/118082368c2b6ddefe6cb607efc312285148f044"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a0e1c9bc1c9fe735978150ad075616a728073bc7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d5be8663cff0ba7b94da34ebd499ce1123b4c334"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2025-68213 (GCVE-0-2025-68213)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:57 – Updated: 2026-05-23 16:02

Title

idpf: fix possible vport_config NULL pointer deref in remove

Summary

In the Linux kernel, the following vulnerability has been resolved: idpf: fix possible vport_config NULL pointer deref in remove Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF: [ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] <TASK> [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0 Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6820 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/a0e1c9bc1c9fe7359…
https://git.kernel.org/stable/c/d5be8663cff0ba7b9…
https://git.kernel.org/stable/c/118082368c2b6ddef…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bd80fbf3ed250ca98923780dab5e634db5d2f828 , < a0e1c9bc1c9fe735978150ad075616a728073bc7 (git) Affected: e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179 , < d5be8663cff0ba7b94da34ebd499ce1123b4c334 (git) Affected: e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179 , < 118082368c2b6ddefe6cb607efc312285148f044 (git) Affected: 5e87b3145578a169839e456fa0aba86e123d2d8e (git) Affected: ba11b0f3e9a97661f6caeee3dfc633af8ecee5a5 (git) Affected: 6.12.43 , < 6.12.60 (semver) Affected: 6.15.11 , < 6.16 (semver) Affected: 6.16.2 , < 6.17 (semver)
Linux	Linux	Affected: 6.17 Unaffected: 0 , < 6.17 (semver) Unaffected: 6.12.60 , ≤ 6.12.* (semver) Unaffected: 6.17.10 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0e1c9bc1c9fe735978150ad075616a728073bc7",
              "status": "affected",
              "version": "bd80fbf3ed250ca98923780dab5e634db5d2f828",
              "versionType": "git"
            },
            {
              "lessThan": "d5be8663cff0ba7b94da34ebd499ce1123b4c334",
              "status": "affected",
              "version": "e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179",
              "versionType": "git"
            },
            {
              "lessThan": "118082368c2b6ddefe6cb607efc312285148f044",
              "status": "affected",
              "version": "e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e87b3145578a169839e456fa0aba86e123d2d8e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ba11b0f3e9a97661f6caeee3dfc633af8ecee5a5",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.60",
              "status": "affected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.12.43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix possible vport_config NULL pointer deref in remove\n\nAttempting to remove the driver will cause a crash in cases where\nthe vport failed to initialize. Following trace is from an instance where\nthe driver failed during an attempt to create a VF:\n[ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated\n[ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms)\n[ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028\n...\n[ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf]\n...\n[ 1723.364973] Call Trace:\n[ 1723.365475]  \u003cTASK\u003e\n[ 1723.365972]  pci_device_remove+0x42/0xb0\n[ 1723.366481]  device_release_driver_internal+0x1a9/0x210\n[ 1723.366987]  pci_stop_bus_device+0x6d/0x90\n[ 1723.367488]  pci_stop_and_remove_bus_device+0x12/0x20\n[ 1723.367971]  pci_iov_remove_virtfn+0xbd/0x120\n[ 1723.368309]  sriov_disable+0x34/0xe0\n[ 1723.368643]  idpf_sriov_configure+0x58/0x140 [idpf]\n[ 1723.368982]  sriov_numvfs_store+0xda/0x1c0\n\nAvoid the NULL pointer dereference by adding NULL pointer check for\nvport_config[i], before freeing user_config.q_coalesce."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:02:21.425Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0e1c9bc1c9fe735978150ad075616a728073bc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5be8663cff0ba7b94da34ebd499ce1123b4c334"
        },
        {
          "url": "https://git.kernel.org/stable/c/118082368c2b6ddefe6cb607efc312285148f044"
        }
      ],
      "title": "idpf: fix possible vport_config NULL pointer deref in remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68213",
    "datePublished": "2025-12-16T13:57:09.046Z",
    "dateReserved": "2025-12-16T13:41:40.256Z",
    "dateUpdated": "2026-05-23T16:02:21.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted