UBUNTU-CVE-2025-22065: Null Pointer Dereference

Q: Which systems are exposed to this issue?

Systems using the idpf driver with SR-IOV enabled are exposed. The affected Ubuntu kernel packages listed are linux-gcp, linux-gke, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-azure-fde, and linux-gkeop.

Q: What is required to trigger the failure?

SR-IOV must be enabled for an idpf network interface, such as by setting sriov_numvfs to a nonzero value. The failure occurs during reboot when the driver removal path is invoked twice.

Q: What is the practical impact?

A reboot can trigger a kernel NULL pointer dereference in idpf_remove(), resulting in a kernel fault. The provided severity vector indicates local access with low privileges is required and the primary impact is availability.

Q: What can be done if the kernel cannot be updated immediately?

Avoid enabling SR-IOV virtual functions on interfaces using the idpf driver. In particular, do not set sriov_numvfs to create VFs until the corrected kernel is deployed.

Published Apr 16, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer dereference on reboot With SRIOV enabled, idpf ends up calling into idpfremove() twice. First via idpfshutdown() and then again when idpfremove() calls into sriovdisable(), because the VF devices use the idpf driver, hence the same remove routine. When that happens, it is possible for the adapter to be NULL from the first call to idpfremove(), leading to a NULL pointer dereference. echo 1 > /sys/class/net/<netif>/device/sriovnumvfs reboot BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:idpfremove+0x22/0x1f0 [idpf] ... ? idpfremove+0x22/0x1f0 [idpf] ? idpfremove+0x1e4/0x1f0 [idpf] pcideviceremove+0x3f/0xb0 devicereleasedriverinternal+0x19f/0x200 pcistopbusdevice+0x6d/0x90 pcistopandremovebusdevice+0x12/0x20 pciiovremovevirtfn+0xbe/0x120 sriovdisable+0x34/0xe0 idpfsriovconfigure+0x58/0x140 [idpf] idpfremove+0x1b9/0x1f0 [idpf] idpfshutdown+0x12/0x30 [idpf] pcideviceshutdown+0x35/0x60 deviceshutdown+0x156/0x200 ... Replace the direct idpfremove() call in idpfshutdown() with idpfvccoredeinit() and idpfdeinitdfltmbx(), which perform the bulk of the cleanup, such as stopping the init task, freeing IRQs, destroying the vports and freeing the mailbox. This avoids the calls to sriovdisable() in addition to a small netdev cleanup, and destroying workqueues, which don't seem to be required on shutdown.

Affected Software

126 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1041.43~22.04.1

6.8.0-1041.43~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1041.47~22.04.1

6.8.0-1041.47~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1042.45~22.04.1

6.8.0-1042.45~22.04.1

ubuntu/linux-gke*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-86.87~22.04.1

6.8.0-86.87~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1039.39~22.04.1

6.8.0-1039.39~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-86.87.1~22.04.1

6.8.0-86.87.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1041.44~22.04.2

6.8.0-1041.44~22.04.2

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1038.39~22.04.1

6.8.0-1038.39~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-86.87~22.04.1

6.8.0-86.87~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1036.37~22.04.1

6.8.1-1036.37~22.04.1

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-86.87

6.8.0-86.87

ubuntu/linux-aws<6.8.0-1041.43

6.8.0-1041.43

ubuntu/linux-azure<6.8.0-1041.47

6.8.0-1041.47

ubuntu/linux-azure-6.11<6.11.0-1018.18~24.04.1

6.11.0-1018.18~24.04.1

ubuntu/linux-azure-nvidia<6.8.0-1029.32

6.8.0-1029.32

ubuntu/linux-gcp<6.8.0-1042.45

6.8.0-1042.45

ubuntu/linux-gcp-6.11<6.11.0-1016.16~24.04.1

6.11.0-1016.16~24.04.1

ubuntu/linux-gke<6.8.0-1038.43

6.8.0-1038.43

ubuntu/linux-gkeop<6.8.0-1025.28

6.8.0-1025.28

ubuntu/linux-hwe-6.11<6.11.0-28.28~24.04.1

6.11.0-28.28~24.04.1

ubuntu/linux-ibm<6.8.0-1039.39

6.8.0-1039.39

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-86.87.1

6.8.0-86.87.1

ubuntu/linux-lowlatency-hwe-6.11<6.11.0-1015.16~24.04.2

6.11.0-1015.16~24.04.2

ubuntu/linux-nvidia<6.8.0-1041.44

6.8.0-1041.44

ubuntu/linux-nvidia-6.11<6.11.0-1012.12

6.11.0-1012.12

ubuntu/linux-nvidia-lowlatency<6.8.0-1041.44.1

6.8.0-1041.44.1

ubuntu/linux-nvidia-tegra<6.8.0-1012.12

6.8.0-1012.12

ubuntu/linux-oem-6.11<6.11.0-1024.24

6.11.0-1024.24

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1038.39

6.8.0-1038.39

ubuntu/linux-raspi<6.8.0-1041.45

6.8.0-1041.45

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-xilinx<6.8.0-1018.19

6.8.0-1018.19

ubuntu/linux-bluefield<6.8.0-1012.16

6.8.0-1012.16

ubuntu/linux-raspi-realtime<6.8.0-2032.33

6.8.0-2032.33

ubuntu/linux-realtime<6.8.1-1036.37

6.8.1-1036.37

ubuntu/linux-aws-fips<6.8.0-1041.43+fips1

6.8.0-1041.43+fips1

ubuntu/linux-azure-fips<6.8.0-1044.50+fips1

6.8.0-1044.50+fips1

ubuntu/linux-fips<6.8.0-86.87+fips1

6.8.0-86.87+fips1

ubuntu/linux-gcp-fips<6.8.0-1042.45+fips1

6.8.0-1042.45+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.43~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.47~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.39~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.44~22.04.2
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1038.39~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1036.37~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.43
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.47
Upgrade
Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.32
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45
Upgrade
Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1038.43
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.28
Upgrade
Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-28.28~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.39
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1015.16~24.04.2
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.44
Upgrade
Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1012.12
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.44.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1012.12
Upgrade
Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1024.24
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1038.39
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.45
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1018.19
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1012.16
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2032.33
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1036.37
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.43+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-86.87+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45+fips1

Event History

Apr 16, 2025

CVE Published

via OSV·03:16 PM

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the idpf driver with SR-IOV enabled are exposed. The affected Ubuntu kernel packages listed are linux-gcp, linux-gke, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-azure-fde, and linux-gkeop.

What is required to trigger the failure?

SR-IOV must be enabled for an idpf network interface, such as by setting sriov_numvfs to a nonzero value. The failure occurs during reboot when the driver removal path is invoked twice.

What is the practical impact?

A reboot can trigger a kernel NULL pointer dereference in idpf_remove(), resulting in a kernel fault. The provided severity vector indicates local access with low privileges is required and the primary impact is availability.

What can be done if the kernel cannot be updated immediately?

Avoid enabling SR-IOV virtual functions on interfaces using the idpf driver. In particular, do not set sriov_numvfs to create VFs until the corrected kernel is deployed.

UBUNTU-CVE-2025-22065: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the failure?

What is the practical impact?

What can be done if the kernel cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the failure?

What is the practical impact?

What can be done if the kernel cannot be updated immediately?