CVE-2025-40053 net: dlink: handle copy_thresh allocation failure
A missing check for memory allocation failure in the D-Link network driver can cause a kernel crash via null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40053?
CVE-2025-40053 is a high-severity vulnerability in Linux, published on 28 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: dlink: handle copy_thresh allocation failure
The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference.
This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path.
Tested-on: D-Link DGE-550T Rev-A3
Which versions are affected by CVE-2025-40053?
How do I fix CVE-2025-40053?
Apply the vendor's patch.
Is CVE-2025-40053 being exploited?
There is no known exploitation of CVE-2025-40053 in the wild and no public exploit code.
Sources
Also known as AZL-68855, BELL-CVE-2025-40053, DEBIAN-CVE-2025-40053, GHSA-xxjc-4ppm-x655, ROOT-OS-DEBIAN-11-CVE-2025-40053, ROOT-OS-DEBIAN-12-CVE-2025-40053 and 4 more.