CVE-2025-21649— net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用。
Possible ATT&CK Techniques 1 AI
T1055 · Process InjectionAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0bf5eb788512187b744ef7f79de835e6cbe85b9c< f19ab3ef96d9626e5f1bdc56d3574c355e83d623 |
affected |
0bf5eb788512187b744ef7f79de835e6cbe85b9c< 9741e72b2286de8b38de9db685588ac421a95c87 |
affected | ||
5.14 |
affected | ||
< 5.14 |
unaffected | ||
6.12.10≤ 6.12.* |
unaffected | ||
6.13≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-21649
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
Currently, HIP08 devices does not register the ptp devices, so the
hdev->ptp is NULL. But the tx process would still try to set hardware time
stamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash.
[ 128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
...
[ 128.280251] pc : hclge_ptp_set_tx_info+0x2c/0x140 [hclge]
[ 128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge]
[ 128.292938] sp : ffff800059b93140
[ 128.297200] x29: ffff800059b93140 x28: 0000000000003280
[ 128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080
[ 128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001
[ 128.315969] x23: 0000000000000000 x22: 0000000000000194
[ 128.322219] x21: ffff0cd94f986000 x20: 0000000000000000
[ 128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000
[ 128.334698] x17: 0000000000000000 x16: ffffcf1fc523ed24
[ 128.340934] x15: 0000ffffd530a518 x14: 0000000000000000
[ 128.347162] x13: ffff0cd6bdb31310 x12: 0000000000000368
[ 128.353388] x11: ffff0cb9cfbc7070 x10: ffff2cf55dd11e02
[ 128.359606] x9 : ffffcf1f85a212b4 x8 : ffff0cd7cf27dab0
[ 128.365831] x7 : 0000000000000a20 x6 : ffff0cd7cf27d000
[ 128.372040] x5 : 0000000000000000 x4 : 000000000000ffff
[ 128.378243] x3 : 0000000000000400 x2 : ffffcf1f85a21294
[ 128.384437] x1 : ffff0cb9db520080 x0 : ffff0cb9db500080
[ 128.390626] Call trace:
[ 128.393964] hclge_ptp_set_tx_info+0x2c/0x140 [hclge]
[ 128.399893] hns3_nic_net_xmit+0x39c/0x4c4 [hns3]
[ 128.405468] xmit_one.constprop.0+0xc4/0x200
[ 128.410600] dev_hard_start_xmit+0x54/0xf0
[ 128.415556] sch_direct_xmit+0xe8/0x634
[ 128.420246] __dev_queue_xmit+0x224/0xc70
[ 128.425101] dev_queue_xmit+0x1c/0x40
[ 128.429608] ovs_vport_send+0xac/0x1a0 [openvswitch]
[ 128.435409] do_output+0x60/0x17c [openvswitch]
[ 128.440770] do_execute_actions+0x898/0x8c4 [openvswitch]
[ 128.446993] ovs_execute_actions+0x64/0xf0 [openvswitch]
[ 128.453129] ovs_dp_process_packet+0xa0/0x224 [openvswitch]
[ 128.459530] ovs_vport_receive+0x7c/0xfc [openvswitch]
[ 128.465497] internal_dev_xmit+0x34/0xb0 [openvswitch]
[ 128.471460] xmit_one.constprop.0+0xc4/0x200
[ 128.476561] dev_hard_start_xmit+0x54/0xf0
[ 128.481489] __dev_queue_xmit+0x968/0xc70
[ 128.486330] dev_queue_xmit+0x1c/0x40
[ 128.490856] ip_finish_output2+0x250/0x570
[ 128.495810] __ip_finish_output+0x170/0x1e0
[ 128.500832] ip_finish_output+0x3c/0xf0
[ 128.505504] ip_output+0xbc/0x160
[ 128.509654] ip_send_skb+0x58/0xd4
[ 128.513892] udp_send_skb+0x12c/0x354
[ 128.518387] udp_sendmsg+0x7a8/0x9c0
[ 128.522793] inet_sendmsg+0x4c/0x8c
[ 128.527116] __sock_sendmsg+0x48/0x80
[ 128.531609] __sys_sendto+0x124/0x164
[ 128.536099] __arm64_sys_sendto+0x30/0x5c
[ 128.540935] invoke_syscall+0x50/0x130
[ 128.545508] el0_svc_common.constprop.0+0x10c/0x124
[ 128.551205] do_el0_svc+0x34/0xdc
[ 128.555347] el0_svc+0x20/0x30
[ 128.559227] el0_sync_handler+0xb8/0xc0
[ 128.563883] el0_sync+0x160/0x180
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-21649
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21649
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-21649 (2)
Same Patch Batch · Linux · 2025-01-19 · 47 CVEs total
| CVE-2025-21631 | 7.8 HIGH | block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() |
| CVE-2025-21652 | 7.8 HIGH | ipvlan: Fix use-after-free in ipvlan_get_iflink(). |
| CVE-2024-57918 | 7.8 HIGH | drm/amd/display: fix page fault due to max surface definition mismatch |
| CVE-2024-57921 | 7.8 HIGH | drm/amdgpu: Add a lock when accessing the buddy trim function |
| CVE-2024-57929 | 7.8 HIGH | dm array: fix releasing a faulty array block twice in dm_array_cursor_end |
| CVE-2024-57926 | 7.8 HIGH | drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err |
| CVE-2025-21646 | 7.5 HIGH | afs: Fix the maximum cell name length |
| CVE-2025-21647 | 7.3 HIGH | sched: sch_cake: add bounds checks to host bulk flow fairness counts |
| CVE-2025-21638 | 7.1 HIGH | sctp: sysctl: auth_enable: avoid using current->nsproxy |
| CVE-2025-21640 | 7.1 HIGH | sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy |
| CVE-2025-21650 | 7.1 HIGH | net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue |
| CVE-2025-21637 | 7.1 HIGH | sctp: sysctl: udp_port: avoid using current->nsproxy |
| CVE-2024-57923 | btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path | |
| CVE-2024-57927 | nfs: Fix oops in nfs_netfs_init_request() when copying to cache | |
| CVE-2024-57914 | usb: typec: tcpci: fix NULL pointer issue on shared irq case | |
| CVE-2024-57913 | usb: gadget: f_fs: Remove WARN_ON in functionfs_bind | |
| CVE-2024-57906 | iio: adc: ti-ads8688: fix information leak in triggered buffer | |
| CVE-2024-57912 | iio: pressure: zpa2326: fix information leak in triggered buffer | |
| CVE-2024-57911 | iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer | |
| CVE-2024-57910 | iio: light: vcnl4035: fix information leak in triggered buffer |
Showing top 20 of 47 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
Same vendor: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
V. Comments for CVE-2025-21649
No comments yet