NULL pointer dereference in Linux kernel - CVE-2025-71293
Published: May 7, 2026
Vulnerability identifier: #VU130623
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-71293
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in amdgpu_ras_sysfs_badpages_read when reading the badpages sysfs entry with eeprom data containing only invalid address entries. A local user can read the affected sysfs entry to cause a denial of service.
The issue occurs in the rare case where allocation is skipped because the eeprom contains only invalid address entries, and it can also result in space left assigned to negative values.
Affected software
Linux kernel
How to mitigate CVE-2025-71293
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3