CVE-2025-38123 net: wwan: t7xx: Fix napi rx poll issue
A null pointer dereference in the Linux kernel t7xx WWAN driver causes a system panic during network disconnection, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38123?
CVE-2025-38123 is a critical vulnerability in Linux kernel, published on 3 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: Fix napi rx poll issue
When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic.
BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)] ? dev_gro_receive+0x3a/0x620 napi_gro_receive+0xad/0x170 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)] t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)] net_rx_action+0x103/0x470 irq_exit_rcu+0x13a/0x310 sysvec_apic_timer_interrupt+0x56/0x90 </IRQ>
Weakness: CWE-476
Which versions are affected by CVE-2025-38123?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38123?
Apply the vendor's patch.
Is CVE-2025-38123 being exploited?
There is no known exploitation of CVE-2025-38123 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-64541, BELL-CVE-2025-38123, DEBIAN-CVE-2025-38123, GHSA-w6m5-2248-xh44, ROOT-OS-UBUNTU-2404-CVE-2025-38123, UBUNTU-CVE-2025-38123.