CVE-2025-38122: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
In the Linux kernel, the following vulnerability has been resolved:
gve: add missing NULL check for gveallocpendingpacket() in TX DQO
gveallocpendingpacket() can return NULL, but gvetxaddskbdqo() did not check for this case before dereferencing the returned pointer.
Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails.
This improves robustness in low-memory scenarios.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a NULL check for the return value of gve_alloc_pending_packet() in gve_tx_add_skb_dqo() before dereferencing it, including when allocation fails.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38122?
CVE-2025-38122 is rated as medium severity due to potential NULL pointer dereference issues.
How do I fix CVE-2025-38122?
To fix CVE-2025-38122, update to a patched version of the Linux kernel that includes the NULL check for gve_alloc_pending_packet().
What systems are affected by CVE-2025-38122?
CVE-2025-38122 affects the Linux kernel across various distributions that use the gve driver.
What is the risk of exploiting CVE-2025-38122?
Exploitation of CVE-2025-38122 could lead to denial of service through system crashes.
Is CVE-2025-38122 fixed in the latest Linux kernel?
Yes, the latest Linux kernel versions include a fix for CVE-2025-38122.