CVE-2025-22033— arm64: Don't call NULL in do_compat_alignment_fixup()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64兼容对齐修复空指针取消引用。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< cf187601053ecaf671ae645edb898901f81d03e9 |
affected |
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< 617a4b0084a547917669fef2b54253cc9c064990 |
affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< 2df8ee605eb6806cd41c2095306db05206633a08 |
affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< fa2a9f625f185c6acb4ee5be8d71359a567afac9 |
affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< ecf798573bbe0805803f7764e12a34b4bcc65074 |
affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< c28f31deeacda307acfee2f18c0ad904e5123aac |
affected | ||
6.1 |
affected | ||
< 6.1 |
unaffected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-22033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
arm64: Don't call NULL in do_compat_alignment_fixup()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
arm64: Don't call NULL in do_compat_alignment_fixup()
do_alignment_t32_to_handler() only fixes up alignment faults for
specific instructions; it returns NULL otherwise (e.g. LDREX). When
that's the case, signal to the caller that it needs to proceed with the
regular alignment fault handling (i.e. SIGBUS). Without this patch, the
kernel panics:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000006
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000
[0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] SMP
Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa>
libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c>
CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1 Debian 6.1.128-1
Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : do_compat_alignment_fixup+0xd8/0x3dc
sp : ffff80000f973dd0
x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001
x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000
x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001
Call trace:
0x0
do_alignment_fault+0x40/0x50
do_mem_abort+0x4c/0xa0
el0_da+0x48/0xf0
el0t_32_sync_handler+0x110/0x140
el0t_32_sync+0x190/0x194
Code: bad PC value
---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64兼容对齐修复空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-22033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-22033
请登录查看更多情报信息。
Other References for CVE-2025-22033 (6)
Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total
| CVE-2025-22021 | 10.0 CRITICAL | netfilter: socket: Lookup orig tuple for IPv6 SNAT |
| CVE-2025-22077 | 9.8 CRITICAL | Revert "smb: client: fix TCP timers deadlock after rmmod" |
| CVE-2025-22088 | 9.8 CRITICAL | RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() |
| CVE-2025-22110 | 9.8 CRITICAL | netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error |
| CVE-2025-22118 | 8.8 HIGH | ice: validate queue quanta parameters to prevent OOB access |
| CVE-2025-22040 | 8.8 HIGH | ksmbd: fix session use-after-free in multichannel connection |
| CVE-2025-22041 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_sessions_deregister() |
| CVE-2025-22039 | 8.8 HIGH | ksmbd: fix overflow in dacloffset bounds check |
| CVE-2025-22086 | 8.8 HIGH | RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow |
| CVE-2024-58096 | 8.8 HIGH | wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode |
| CVE-2025-22074 | 8.8 HIGH | ksmbd: fix r_count dec/increment mismatch |
| CVE-2025-23133 | 8.8 HIGH | wifi: ath11k: update channel list in reg notifier instead reg worker |
| CVE-2025-22117 | 8.7 HIGH | ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() |
| CVE-2025-22108 | 8.6 HIGH | bnxt_en: Mask the bd_cnt field in the TX BD properly |
| CVE-2025-22121 | 8.4 HIGH | ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() |
| CVE-2025-22080 | 8.4 HIGH | fs/ntfs3: Prevent integer overflow in hdr_first_de() |
| CVE-2025-22038 | 8.3 HIGH | ksmbd: validate zero num_subauth before sub_auth is accessed |
| CVE-2025-22042 | 8.1 HIGH | ksmbd: add bounds check for create lease context |
| CVE-2025-22043 | 8.1 HIGH | ksmbd: add bounds check for durable handle context |
| CVE-2025-22047 | 7.8 HIGH | x86/microcode/AMD: Fix __apply_microcode_amd()'s return value |
Showing top 20 of 127 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()