Cyber Resilience

CVE-2025-21676

Memory Safety in Linux Kernel 6.1 – 6.6.74

Published
31 January 2025
Modified
14 July 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0020 10th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-21676 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-11 (Error Handling) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to…

more

use the NULL pointer and then crash. This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min_free_kbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash. This commit handles the allocation error by dropping the current packet.

CWE(s)

Related Threats

CVEs Like This One

CVE-2026-23353Same product: Linux Linux Kernel
CVE-2023-53336Same product: Linux Linux Kernel
CVE-2025-71124Same product: Linux Linux Kernel
CVE-2026-31481Same product: Linux Linux Kernel
CVE-2024-58237Same product: Linux Linux Kernel
CVE-2025-37974Same product: Linux Linux Kernel
CVE-2025-21799Same product: Linux Linux Kernel
CVE-2025-22016Same product: Linux Linux Kernel
CVE-2023-52893Same product: Linux Linux Kernel
CVE-2025-22065Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
6.13 · 6.1 — 6.6.74 · 6.7 — 6.12.11

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires the system to detect and handle the page allocation failure (NULL return) instead of dereferencing it and crashing.

prevent

Ensures the fec driver fails in a known state (drop packet) rather than entering undefined behavior on memory exhaustion.

prevent

Requires fail-safe behavior when resource allocation fails, mitigating the NULL-pointer crash path under memory pressure.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect NULL dereference defects before release.

prevents

Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.

prevents

Application security requirements can specify input validation and pointer-safety rules.

prevents

Secure architecture principles encourage defensive design that avoids unsafe pointer use.

prevents

Secure coding standards directly require NULL-pointer checks and safe dereference patterns.

References