{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-21675 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-21675 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-21675 and fix it if it is affected.\n\nWhat it is: CVE-2025-21675 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-21675 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-21675/ (Markdown: https://insights.sbomify.com/CVE-2025-21675/index.md)","id":"CVE-2025-21675","markdown":"https://insights.sbomify.com/CVE-2025-21675/index.md","name":"CVE-2025-21675","record":{"aliases":["AZL-56390","BELL-CVE-2025-21675","DEBIAN-CVE-2025-21675","GHSA-wfp2-gq58-rf57","UBUNTU-CVE-2025-21675"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A null pointer dereference in the mlx5 network driver causes a kernel crash when port selection creation fails, leading to denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clear port select structure when fail to create\n\nClear the port select structure on error so no stale values left after\ndefiners are destroyed. That's because the mlx5_lag_destroy_definers()\nalways try to destroy all lag definers in the tt_map, so in the flow\nbelow lag definers get double-destroyed and cause kernel crash:\n\n  mlx5_lag_port_sel_create()\n    mlx5_lag_create_definers()\n      mlx5_lag_create_definer()     \u003c- Failed on tt 1\n        mlx5_lag_destroy_definers() \u003c- definers[tt=0] gets destroyed\n  mlx5_lag_port_sel_create()\n    mlx5_lag_create_definers()\n      mlx5_lag_create_definer()     \u003c- Failed on tt 0\n        mlx5_lag_destroy_definers() \u003c- definers[tt=0] gets double-destroyed\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n Mem abort info:\n   ESR = 0x0000000096000005\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n   FSC = 0x05: level 1 translation fault\n Data abort info:\n   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n user pgtable: 64k pages, 48-bit VAs, pgdp=0000000112ce2e00\n [0000000000000008] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n Modules linked in: iptable_raw bonding ip_gre ip6_gre gre ip6_tunnel tunnel6 geneve ip6_udp_tunnel udp_tunnel ipip tunnel4 ip_tunnel rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) mlx5_fwctl(OE) fwctl(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlxfw(OE) memtrack(OE) mlx_compat(OE) openvswitch nsh nf_conncount psample xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo xt_addrtype iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc netconsole overlay efi_pstore sch_fq_codel zram ip_tables crct10dif_ce qemu_fw_cfg fuse ipv6 crc_ccitt [last unloaded: mlx_compat(OE)]\n  CPU: 3 UID: 0 PID: 217 Comm: kworker/u53:2 Tainted: G           OE      6.11.0+ #2\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n  Workqueue: mlx5_lag mlx5_do_bond_work [mlx5_core]\n  pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : mlx5_del_flow_rules+0x24/0x2c0 [mlx5_core]\n  lr : mlx5_lag_destroy_definer+0x54/0x100 [mlx5_core]\n  sp : ffff800085fafb00\n  x29: ffff800085fafb00 x28: ffff0000da0c8000 x27: 0000000000000000\n  x26: ffff0000da0c8000 x25: ffff0000da0c8000 x24: ffff0000da0c8000\n  x23: ffff0000c31f81a0 x22: 0400000000000000 x21: ffff0000da0c8000\n  x20: 0000000000000000 x19: 0000000000000001 x18: 0000000000000000\n  x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8b0c9350\n  x14: 0000000000000000 x13: ffff800081390d18 x12: ffff800081dc3cc0\n  x11: 0000000000000001 x10: 0000000000000b10 x9 : ffff80007ab7304c\n  x8 : ffff0000d00711f0 x7 : 0000000000000004 x6 : 0000000000000190\n  x5 : ffff00027edb3010 x4 : 0000000000000000 x3 : 0000000000000000\n  x2 : ffff0000d39b8000 x1 : ffff0000d39b8000 x0 : 0400000000000000\n  Call trace:\n   mlx5_del_flow_rules+0x24/0x2c0 [mlx5_core]\n   mlx5_lag_destroy_definer+0x54/0x100 [mlx5_core]\n   mlx5_lag_destroy_definers+0xa0/0x108 [mlx5_core]\n   mlx5_lag_port_sel_create+0x2d4/0x6f8 [mlx5_core]\n   mlx5_activate_lag+0x60c/0x6f8 [mlx5_core]\n   mlx5_do_bond_work+0x284/0x5c8 [mlx5_core]\n   process_one_work+0x170/0x3e0\n   worker_thread+0x2d8/0x3e0\n   kthread+0x11c/0x128\n   ret_from_fork+0x10/0x20\n  Code: a9025bf5 aa0003f6 a90363f7 f90023f9 (f9400400)\n  ---[ end trace 0000000000000000 ]---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net/mlx5: Clear port select structure when fail to create","id":"CVE-2025-21675","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2025"},"n_packages":0,"n_references":4,"next":{"headline":"net: fec: handle page_pool_dev_alloc_pages error","id":"CVE-2025-21676"},"packages":[],"prev":{"headline":"net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel","id":"CVE-2025-21674"},"products":["Linux"],"published":"2025-01-31","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A null pointer dereference in the mlx5 network driver causes a kernel crash when port selection creation fails, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2025-21675/"}