Description

In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer in skb_segment_list Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched when passing through the network stack. This assumption can be broken sometimes, where frag_list itself gets pulled into linear area, leaving frag_list being NULL. When this happens it can trigger following NULL pointer dereference, and panic the kernel. Reverse the test condition should fix it. [19185.577801][ C1] BUG: kernel NULL pointer dereference, address: ... [19185.663775][ C1] RIP: 0010:skb_segment_list+0x1cc/0x390 ... [19185.834644][ C1] Call Trace: [19185.841730][ C1] <TASK> [19185.848563][ C1] __udp_gso_segment+0x33e/0x510 [19185.857370][ C1] inet_gso_segment+0x15b/0x3e0 [19185.866059][ C1] skb_mac_gso_segment+0x97/0x110 [19185.874939][ C1] __skb_gso_segment+0xb2/0x160 [19185.883646][ C1] udp_queue_rcv_skb+0xc3/0x1d0 [19185.892319][ C1] udp_unicast_rcv_skb+0x75/0x90 [19185.900979][ C1] ip_protocol_deliver_rcu+0xd2/0x200 [19185.910003][ C1] ip_local_deliver_finish+0x44/0x60 [19185.918757][ C1] __netif_receive_skb_one_core+0x8b/0xa0 [19185.927834][ C1] process_backlog+0x88/0x130 [19185.935840][ C1] __napi_poll+0x27/0x150 [19185.943447][ C1] net_rx_action+0x27e/0x5f0 [19185.951331][ C1] ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core] [19185.960848][ C1] __do_softirq+0xbc/0x25d [19185.968607][ C1] irq_exit_rcu+0x83/0xb0 [19185.976247][ C1] common_interrupt+0x43/0xa0 [19185.984235][ C1] asm_common_interrupt+0x22/0x40 ... [19186.094106][ C1] </TASK>

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54	Patch
https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6	Patch
https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d	Patch
https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Configuration 1 ( hide )

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*    Show Matching CPE(s)	From (including) 5.6	Up to (excluding) 5.10.167
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*    Show Matching CPE(s)	From (including) 5.11	Up to (excluding) 5.15.92
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*    Show Matching CPE(s)	From (including) 5.16	Up to (excluding) 6.1.10
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*    Show Matching CPE(s)
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*    Show Matching CPE(s)
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*    Show Matching CPE(s)
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*    Show Matching CPE(s)
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*    Show Matching CPE(s)
cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*    Show Matching CPE(s)

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 4/15/2025 10:32:09 AM

Action	Type	Old Value	New Value
Added	CVSS V3.1		AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		CWE-476
Added	CPE Configuration		Record truncated, showing 500 of 700 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.6 up to (excluding) 5.10.167 *cpe:2.3:o:lin
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d Types: Patch

New CVE Received from kernel.org 3/27/2025 1:15:46 PM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 1717 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer in skb_segment_list Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched when passing through the network stack. This assumption can be broken sometimes, where frag_list itself gets pulled into linear area, leaving frag_list being NULL. When this happens it can trigger following NULL pointer dereference, and pani
Added	Reference		https://git.kernel.org/stable/c/046de74f9af92ae9ffce75fa22a1795223f4fb54
Added	Reference		https://git.kernel.org/stable/c/6446369fb9f083ce032448c5047da08e298b22e6
Added	Reference		https://git.kernel.org/stable/c/876e8ca8366735a604bac86ff7e2732fc9d85d2d
Added	Reference		https://git.kernel.org/stable/c/888dad6f3e85e3b2f8389bd6478f181efc72534d