7.5

CVE-2025-37755: linux NULL Pointer Dereference

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2025-37755DEBIAN-CVE-2025-37755
Published 01-05-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-37755 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.37%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 30 · Related 30
SUSE-SU-2025:01919-1SUSE-SU-2025:01951-1SUSE-SU-2025:01964-1SUSE-SU-2025:01965-1SUSE-SU-2025:01967-1SUSE-SU-2025:01972-1

Timeline

  1. 01-05-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: libwx: handle page_pool_dev_alloc_pages error page_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page) but it would still proceed to use the NULL pointer and then crash. This is similar to commit 001ba0902046 ("net: fec: handle page_pool_dev_alloc_pages error"). This is found by our static analysis tool KNighter.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

+0.01 pp

From 0.35% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu112 products
  • linux< 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 3c47e8ae113a68da47987750d9896e325d0aeedd, < c17ef974bfcf1a50818168b47c4606b425a957c4 | ≥ 3c47e8ae113a68da47987750d9896e325d0aeedd, < ad81d666e114ebf989fc9994d4c93d451dc60056 | ≥ 3c47e8ae113a68da47987750d9896e325d0aeedd, < 1dd13c60348f515acd8c6f25a561b9c4e3b04fea | ≥ 3c47e8ae113a68da47987750d9896e325d0aeedd, < 90bec7cef8805f9a23145e070dff28a02bb584eb | ≥ 3c47e8ae113a68da47987750d9896e325d0aeedd, < 7f1ff1b38a7c8b872382b796023419d87d78c47e | 6.3
  • linux_kernel≥ 6.3, < 6.6.88 | ≥ 6.7, < 6.12.24 | ≥ 6.13, < 6.13.12 | ≥ 6.14, < 6.14.3 | 6.15:rc1
Debian1 product
  • linux< 6.12.25-1

3 vendors · 115 products

References

29 links
Show all 29 references