5.5

CVE-2025-21670: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2025-21670DEBIAN-CVE-2025-21670
Published 31-01-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2025-21670 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 18
SUSE-SU-2025:0499-1SUSE-SU-2025:0557-1SUSE-SU-2025:0564-1SUSE-SU-2025:0847-1SUSE-SU-2025:20190-1SUSE-SU-2025:20192-1

Timeline

  1. 31-01-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace: BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg().

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

0.00 pp

From 0.22% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu106 products
  • linux< 6.8.0-62.65
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1030.32
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 634f1a7110b439c65fd8a809171c1d2d28bcea6f, < 58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 | ≥ 634f1a7110b439c65fd8a809171c1d2d28bcea6f, < 6771e1279dadf1d92a72e1465134257d9e6f2459 | ≥ 634f1a7110b439c65fd8a809171c1d2d28bcea6f, < f6abafcd32f9cfc4b1a2f820ecea70773e26d423 | 6.4
  • linux_kernel≥ 6.4, < 6.6.74 | ≥ 6.7, < 6.12.11 | 6.13:rc1 | 6.13:rc2 | 6.13:rc3 | 6.13:rc4 | 6.13:rc5 | 6.13:rc6 | 6.13:rc7
Debian1 product
  • linux< 6.12.11-1

3 vendors · 109 products

References

18 links
Show all 18 references