NULL pointer dereference in Linux kernel scsi driver



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-21957
CWE-ID CWE-476
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) NULL pointer dereference

EUVDB-ID: #VU106695

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21957

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qla1280_64bit_start_scsi() function in drivers/scsi/qla1280.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.6 - 6.6.83

CPE2.3 External links

https://git.kernel.org/stable/c/24602e2664c515a4f2950d7b52c3d5997463418c
https://git.kernel.org/stable/c/5233e3235dec3065ccc632729675575dbe3c6b8a
https://git.kernel.org/stable/c/7ac2473e727d67a38266b2b7e55c752402ab588c
https://git.kernel.org/stable/c/af71ba921d08c241a817010f96458dc5e5e26762
https://git.kernel.org/stable/c/ea371d1cdefb0951c7127a33bcd7eb931cf44571
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.84


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###