CVE-2025-22054: arcnet: Add NULL check in com20020pci_probe()
arcnet: Add NULL check in com20020pciprobe()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In com20020pci_probe(), after each devm_kasprintf() call, add a NULL check for the returned pointer. If it is NULL (allocation failure), return the appropriate error so that no further dereference occurs and ensure allocated resources are not leaked.
Linux kernel arcnet driver (com20020pci_probe()) NULL check after devm_kasprintf() = Add explicit NULL check for the return value of devm_kasprintf() and handle allocation failure
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22054?
CVE-2025-22054 is categorized as a high severity vulnerability due to its potential to cause a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2025-22054?
To fix CVE-2025-22054, update your Linux kernel to the latest version that contains the patch addressing this vulnerability.
Which versions of the Linux Kernel are affected by CVE-2025-22054?
CVE-2025-22054 affects Linux kernel versions between 4.19.302 and 4.20, 5.4.264 and 5.4.292, 5.10.204 and 5.10.236, 5.15.143 and 5.15.180, 6.1.68 and 6.1.134, 6.6.7 and 6.6.87, 6.7 and 6.12.23, 6.13 and 6.13.11, and 6.14 and 6.14.2.
What components are impacted by CVE-2025-22054?
CVE-2025-22054 impacts the arcnet driver in the Linux kernel.
Is CVE-2025-22054 remote exploitable?
CVE-2025-22054 is not considered remote exploitable as it requires local access to the affected system.