CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler.
In the Linux kernel, the following vulnerability has been resolved:
sched: address a potential NULL pointer dereference in the GRED scheduler.
If kzalloc in gredinit returns a NULL pointer, the code follows the error handling path, invoking greddestroy. This, in turn, calls gredoffload, where memset could receive a NULL pointer as input, potentially leading to a kernel crash.
When table->opt is NULL in gredinit(), gredchangetabledef() is not called yet, so it is not necessary to call ->ndosetuptc() in gredoffload().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21980?
CVE-2025-21980 has been classified as a moderate severity vulnerability due to the potential for a NULL pointer dereference in the GRED scheduler.
How do I fix CVE-2025-21980?
To address CVE-2025-21980, update to the latest version of the Linux kernel that includes the fix for this vulnerability.
What are the potential impacts of CVE-2025-21980?
The potential impact of CVE-2025-21980 includes system instability or crashes due to NULL pointer dereference in the GRED scheduler.
Which versions of the Linux kernel are affected by CVE-2025-21980?
CVE-2025-21980 affects various versions of the Linux kernel prior to the fix being implemented in subsequent releases.
Is there a workaround for CVE-2025-21980?
There are no recommended workarounds for CVE-2025-21980; updating the kernel is the primary response for mitigation.