CVE-2025-40089
BaseFortify
Publication date: 2025-10-30
Last updated on: 2025-10-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a NULL pointer dereference in the Linux kernel's cxl_feature_info function. When the hardware does not support certain features, the cxl_feature_info function may receive a NULL pointer (cxlfs) and attempt to dereference it, causing a kernel crash (Oops). The fix adds a check for the NULL pointer and returns an error if no features are supported, preventing the crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when accessing unsupported hardware features. This can lead to system instability, unexpected reboots, or denial of service on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring your system logs for kernel NULL pointer dereference errors related to cxl_feature_info. Look for messages similar to: '[timestamp] BUG: kernel NULL pointer dereference, address: 0000000000000008' or 'Oops: Oops: 0000 [#1] SMP NOPTI' referencing cxl_feature_info in the kernel logs. Use commands like 'dmesg | grep cxl_feature_info' or 'journalctl -k | grep cxl_feature_info' to find such entries.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating your Linux kernel to a version that includes the fix which adds a check for cxlfs before dereferencing it, preventing NULL pointer dereference. Until the update is applied, avoid using hardware or features that trigger cxl_feature_info calls if possible.