#VU106674 NULL pointer dereference in Linux kernel - CVE-2025-21948
Vulnerability identifier: #VU106674
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-476
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the appleir_raw_event() function in drivers/hid/hid-appleir.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 6.6, 6.6 rc1, 6.6 rc2, 6.6 rc3, 6.6 rc4, 6.6 rc5, 6.6 rc6, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 6.6.13, 6.6.14, 6.6.15, 6.6.16, 6.6.17, 6.6.18, 6.6.19, 6.6.20, 6.6.21, 6.6.22, 6.6.23, 6.6.24, 6.6.25, 6.6.26, 6.6.27, 6.6.28, 6.6.29, 6.6.30, 6.6.31, 6.6.32, 6.6.33, 6.6.34, 6.6.35, 6.6.36, 6.6.37, 6.6.38, 6.6.39, 6.6.40, 6.6.41, 6.6.42, 6.6.43, 6.6.44, 6.6.45, 6.6.46, 6.6.47, 6.6.48, 6.6.49, 6.6.50, 6.6.51, 6.6.52, 6.6.53, 6.6.54, 6.6.55, 6.6.56, 6.6.57, 6.6.58, 6.6.59, 6.6.60, 6.6.61, 6.6.62, 6.6.63, 6.6.64, 6.6.65, 6.6.66, 6.6.67, 6.6.68, 6.6.69, 6.6.70, 6.6.71, 6.6.72, 6.6.73, 6.6.74, 6.6.75, 6.6.76, 6.6.77, 6.6.78, 6.6.79, 6.6.80, 6.6.81, 6.6.82
External links
https://git.kernel.org/stable/c/0df1ac8ee417ad76760ff076faa4518a4d861894
https://git.kernel.org/stable/c/2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1
https://git.kernel.org/stable/c/68cdf6710f228dfd74f66ec61fbe636da2646a73
https://git.kernel.org/stable/c/6db423b00940b05df2a1265d3c7eabafe9f1734c
https://git.kernel.org/stable/c/8d39eb8c5e14f2f0f441eed832ef8a7b654e6fee
https://git.kernel.org/stable/c/b1d95d733cd6e74f595653daddcfc357bea461e8
https://git.kernel.org/stable/c/d335fce8b88b2353f4bb20c631698e20384e3610
https://git.kernel.org/stable/c/fc69e2c3219d433caabba4b5d6371ba726a4b37f
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.83
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
