CVE-2025-22054

arcnet: Add NULL check in com20020pci_probe()

5.5 MediumFix available

What does this mean?

: 5.5v3.1, from NVD
: 0.23%14th percentile
Fixed in: 6.1.134-r0linux-lts
Published: April 16, 2025
Modified: November 11, 2026
Weakness: CWE-476
Also known as: BELL-CVE-2025-22054CLSA-2025-1757963029DEBIAN-CVE-2025-22054DLA-4178-1DLA-4193-1DSA-5907-1EUVD-2025-11243GHSA-6pg5-wf6r-xvh8
Show 45 moreShow less
MGASA-2025-0142MGASA-2025-0146OESA-2025-1878OESA-2025-1879OESA-2025-1880ROOT-OS-UBUNTU-2404-CVE-2025-22054UBUNTU-CVE-2025-22054USN-7585-1USN-7585-2USN-7585-3USN-7585-4USN-7585-5USN-7585-6USN-7585-7USN-7591-1USN-7591-2USN-7591-3USN-7591-4USN-7591-5USN-7591-6USN-7592-1USN-7593-1USN-7594-1USN-7594-2USN-7594-3USN-7597-1USN-7597-2USN-7598-1USN-7602-1USN-7605-1USN-7605-2USN-7606-1USN-7628-1USN-7640-1USN-7655-1USN-7835-1USN-7835-2USN-7835-3USN-7835-4USN-7835-5USN-7835-6USN-7887-1USN-7887-2USN-7940-1USN-7940-2

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.23%Up 0.2 points since Apr 17, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

CVE List 5.5

arcnet: Add NULL check in com20020pci_probe()

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2025-11243 5.5

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: EUVD-2025-11243
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6pg5-wf6r-xvh8 5.5

In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in...

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: GHSA-6pg5-wf6r-xvh8
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2025-22054 5.5

Record: BELL-CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

arcnet: Add NULL check in com20020pci_probe()

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVDEBIAN-CVE-2025-22054 5.5

In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pci_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated.

Record: DEBIAN-CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-1878 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers.

Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected:

int tail_call(struct __sk_buff *sk)
{
	bpf_tail_call_static(sk, &amp;jmp_table, 0);
	return 0;
}

SEC(&quot;tc&quot;)
int not_safe(struct __sk_buff *sk)
{
	int *p = (void *)(long)sk-&gt;data;
	... make p valid ...
	tail_call(sk);
	*p = 42; /* this is unsafe */
	...
}

The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.(CVE-2024-58237)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

The Call Trace is as below: " <TASK> ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? report_bug+0x105/0x180 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __rxe_cleanup+0x124/0x170 [rdma_rxe] rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe] ib_destroy_qp_user+0x118/0x190 [ib_core] rdma_destroy_qp.cold+0x43/0x5e [rdma_cm] rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core] rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server] process_one_work+0x21d/0x3f0 worker_thread+0x4a/0x3c0 ? process_one_work+0x3f0/0x3f0 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> " When too many rdma resources are allocated, rxe needs more time to handle these rdma resources. Sometimes with the current timeout, rxe can not release the rdma resources correctly.

Compared with other rdma drivers, a bigger timeout is used.(CVE-2025-21829)

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC

Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash if VFs are used to test one-step timestamp, the crash log as follows.

[ 129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0 [ 129.287769] Call trace: [ 129.290219] enetc_port_mac_wr+0x30/0xec (P) [ 129.294504] enetc_start_xmit+0xda4/0xe74 [ 129.298525] enetc_xmit+0x70/0xec [ 129.301848] dev_hard_start_xmit+0x98/0x118(CVE-2025-21894)

In the Linux kernel, the following vulnerability has been resolved:

caif_virtio: fix wrong pointer check in cfv_probe()

del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL.

Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs().(CVE-2025-21904)

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: do not update checksum in bnxt_xdp_build_skb()

The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it returns XDP_PASS, the bnxt_xdp_build_skb() is called to update skb_shared_info. The main purpose of bnxt_xdp_build_skb() is to update skb_shared_info, but it updates ip_summed value too if checksum offload is enabled. This is actually duplicate work.

When…

Record: OESA-2025-1878
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1879 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers.

int tail_call(struct __sk_buff *sk)
{
	bpf_tail_call_static(sk, &amp;jmp_table, 0);
	return 0;
}

SEC(&quot;tc&quot;)
int not_safe(struct __sk_buff *sk)
{
	int *p = (void *)(long)sk-&gt;data;
	... make p valid ...
	tail_call(sk);
	*p = 42; /* this is unsafe */
	...
}

In the Linux kernel, the following vulnerability has been resolved:

netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.(CVE-2025-21703)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

Compared with other rdma drivers, a bigger timeout is used.(CVE-2025-21829)

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC

In the Linux kernel, the following vulnerability has been resolved:

caif_virtio: fix wrong pointer check in cfv_probe()

Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs().(CVE-2025-21904)

In the Linux kernel, the…

Record: OESA-2025-1879
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1880 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers.

int tail_call(struct __sk_buff *sk)
{
	bpf_tail_call_static(sk, &amp;jmp_table, 0);
	return 0;
}

SEC(&quot;tc&quot;)
int not_safe(struct __sk_buff *sk)
{
	int *p = (void *)(long)sk-&gt;data;
	... make p valid ...
	tail_call(sk);
	*p = 42; /* this is unsafe */
	...
}

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: do not update checksum in bnxt_xdp_build_skb()

When the bnxt_rx_pkt() updates ip_summed value, it checks if ip_summed is CHECKSUM_NONE or not. It means that ip_summed should be CHECKSUM_NONE at this moment. But ip_summed may already be updated to CHECKSUM_UNNECESSARY in the XDP-MB-PASS path. So the by skb_checksum_none_assert() WARNS about it.

This is duplicate work and updating ip_summed in the bnxt_xdp_build_skb() is not needed.

Splat looks like: WARNING: CPU: 3 PID: 5782 at ./include/linux/skbuff.h:5155 bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Modules linked in: bnxt_re bnxt_en rdma_ucm rdma_cm iw_cm ib_cm ib_uverbs veth xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_] CPU: 3 UID: 0 PID: 5782 Comm: socat Tainted: G W 6.14.0-rc4+ #27 Tainted: [W]=WARN Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Code: 54 24 0c 4c 89 f1 4c 89 ff c1 ea 1f ff d3 0f 1f 00 49 89 c6 48 85 c0 0f 84 4c e5 ff ff 48 89 c7 e8 ca 3d a0 c8 e9 8f f4 ff ff <0f> 0b f RSP: 0018:ffff88881ba09928 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000c7590303 RCX: 0000000000000000 RDX: 1ffff1104e7d1610 RSI: 0000000000000001 RDI: ffff8881c91300b8 RBP: ffff88881ba09b28 R08: ffff888273e8b0d0 R09: ffff888273e8b070 R10: ffff888273e8b010 R11: ffff888278b0f000 R12: ffff888273e8b080 R13: ffff8881c9130e00 R14: ffff8881505d3800 R15: ffff888273e8b000 FS: 00007f5a2e7be080(0000) GS:ffff88881ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff2e708ff8 CR3: 000000013e3b0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0xcd/0x2f0 ? bnxt_rx_pkt+0x479b/0x7610 ? report_bug+0x326/0x3c0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? bnxt_rx_pkt+0x479b/0x7610 ? bnxt_rx_pkt+0x3e41/0x7610 ? __pfx_bnxt_rx_pkt+0x10/0x10 ? napi_complete_done+0x2cf/0x7d0 __bnxt_poll_work+0x4e8/0x1220 ? __pfx___bnxt_poll_work+0x10/0x10 ? __pfx_mark_lock.part.0+0x10/0x10 bnxt_poll_p5+0x36a/0xfa0 ? __pfx_bnxt_poll_p5+0x10/0x10 __napi_poll.constprop.0+0xa0/0x440 net_rx_action+0x899/0xd00 ...

Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.(CVE-2025-21960)

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: fix truesize for…

Record: OESA-2025-1880
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-22054 5.5

CVE-2025-22054 in linux - Patched by Root

Root has patched CVE-2025-22054 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-22054 5.5

Record: UBUNTU-CVE-2025-22054
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2025-1757963029 No score

kernel-uek: Fix of 195 CVEs

rds: tcp: block BH in TCP callbacks
kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
module: potential uninitialized return in module_kallsyms_on_each_symbol()
module: use RCU to synchronize find_module
kallsyms: refactor {,module_}kallsyms_on_each_symbol
LTS tag: v5.4.295
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
perf: Fix sample vs do_exit() {CVE-2025-38424}
s390/pci: Fix __pcilg_mio_inuser() inline assembly
rtc: test: Fix invalid format specifier.
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
rtc: Make rtc_time64_to_tm() support dates before 1970
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
net: atm: add lec_mutex {CVE-2025-38323}
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
hwmon: (occ) fix unaligned accesses
drm/nouveau/bl: increase buffer size to avoid truncate warning
erofs: remove unused trace event erofs_destroy_inode
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
Input: sparcspkr - avoid unannotated fall-through
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
scsi: s390: zfcp: Ensure synchronous unit_add
scsi: storvsc: Increase the timeouts to storvsc_timeout
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
platform/x86: dell_rbu: Stop overwriting data buffer
platform: Add Surface platform directory
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
tee: Prevent size calculation wraparound on 32-bit kernels
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
watchdog: da9052_wdt: respect TWDMIN
i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
sock: Correct error checking condition for (assign|release)_proto_idx()
scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
vxlan: Do not treat dst cache initialization errors as fatal
clk: rockchip: rk3036: mark ddrphy as critical
wifi: mac80211: do not offer a mesh path if forwarding is disabled
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
pinctrl: armada-37xx:…

Record: CLSA-2025-1757963029
Updated: 2026-11-02

OSVMGASA-2025-0142 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.87 fixes bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2025-0142
Updated: 2026-11-02

OSVMGASA-2025-0146 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.88 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2025-0146
Updated: 2026-11-02

OSVUSN-7585-1 No score

linux, linux-aws, linux-aws-5.4, linux-azure, linux-gcp, linux-gcp-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)