CVE-2025-40033 remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
A local attacker with high privileges can cause a denial of service in the Linux kernel via a NULL pointer dereference in the PRU remoteproc driver.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40033?
CVE-2025-40033 is a vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer.
Which versions are affected by CVE-2025-40033?
How do I fix CVE-2025-40033?
Apply the vendor's patch.
Is CVE-2025-40033 being exploited?
There is no known exploitation of CVE-2025-40033 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40033, DEBIAN-CVE-2025-40033, GHSA-7wxp-97wr-wj5g, ROOT-OS-DEBIAN-13-CVE-2025-40033, ROOT-OS-UBUNTU-2404-CVE-2025-40033, UBUNTU-CVE-2025-40033.