CVE-2025-22050: usbnet:fix NPE during rx_complete
Published Apr 16, 2025
·Updated
In the Linux kernel, the following vulnerability has been resolved:
usbnet:fix NPE during rxcomplete
Missing usbnetgoingaway Check in Critical Path. The usbsubmiturb function lacks a usbnetgoingaway validation, whereas usbnetqueueskb includes this check.
This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued.
Subsequent processes: (e.g., rxcomplete → deferbh → skbunlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic).
Affected Software
9 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=5.15.168<5.15.180
Linux Linux kernel>=6.1.113<6.1.134
Linux Linux kernel>=6.6.54<6.6.87
Linux Linux kernel>=6.10.13<6.11
Linux Linux kernel>=6.11.2<6.12.23
Linux Linux kernel>=6.13<6.13.11
Linux Linux kernel>=6.14<6.14.2
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Apr 16, 2025
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
Description
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software