Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38255— lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于group_cpus_evenly函数未正确处理空指针，可能导致内核崩溃。

AI Predicted 7.8 Difficulty: Easy EPSS 0.17% · P5

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 6a6dcae8f486c3f3298d0767d34505121c7b0b81< 64a99eff8dcf1f951a544e6058341b2b19a8fdbd affected
6a6dcae8f486c3f3298d0767d34505121c7b0b81< 29d39e0d5f16c060e32542b2cf351c09fd22b250 affected
6a6dcae8f486c3f3298d0767d34505121c7b0b81< 911ef2e8a7de5b2bae8ff11fb0bd01f699e6db65 affected
6a6dcae8f486c3f3298d0767d34505121c7b0b81< df831e97739405ecbaddb85516bc7d4d1c933d6b affected
6.3 affected
< 6.3 unaffected
6.6.96≤ 6.6.* unaffected
6.12.36≤ 6.12.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38255

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__bitmap_or+0x48/0x70 Call Trace: <TASK> __group_cpus_evenly+0x822/0x8c0 group_cpus_evenly+0x2d9/0x490 blk_mq_map_queues+0x1e/0x110 null_map_queues+0xc9/0x170 [null_blk] blk_mq_update_queue_map+0xdb/0x160 blk_mq_update_nr_hw_queues+0x22b/0x560 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_poll_queues_store+0xa4/0x130 [null_blk] configfs_write_iter+0x109/0x1d0 vfs_write+0x26e/0x6f0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x45c4/0x45f0 do_syscall_64+0xa5/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from kcalloc(), and later ZERO_SIZE_PTR will be deferenced. Fix the problem by checking numgrps first in group_cpus_evenly(), and return NULL directly if numgrps is zero. [yukuai3@huawei.com: also fix the non-SMP version]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于group_cpus_evenly函数未正确处理空指针，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6a6dcae8f486c3f3298d0767d34505121c7b0b81 ~ 64a99eff8dcf1f951a544e6058341b2b19a8fdbd -
Linux Linux 6.3 -

II. Public POCs for CVE-2025-38255

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38255

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-09 · 26 CVEs total

CVE-2025-38264 9.8 CRITICAL nvme-tcp: sanitize request list handling
CVE-2025-38246 9.8 CRITICAL bnxt: properly flush XDP redirect lists
CVE-2025-38253 8.8 HIGH HID: wacom: fix crash in wacom_aes_battery_handler()
CVE-2025-38238 8.8 HIGH scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out
CVE-2025-38252 7.8 HIGH cxl/ras: Fix CPER handler device confusion
CVE-2025-38261 7.8 HIGH riscv: save the SR_SUM status over switches
CVE-2025-38262 7.8 HIGH tty: serial: uartlite: register uart driver in init
CVE-2025-38250 7.8 HIGH Bluetooth: hci_core: Fix use-after-free in vhci_flush()
CVE-2025-38242 7.8 HIGH mm: userfaultfd: fix race of userfaultfd_move and swap cache
CVE-2025-38248 7.8 HIGH bridge: mcast: Fix use-after-free during router port configuration
CVE-2025-38244 7.5 HIGH smb: client: fix potential deadlock when reconnecting channels
CVE-2025-38239 7.3 HIGH scsi: megaraid_sas: Fix invalid node index
CVE-2025-38257 7.3 HIGH s390/pkey: Prevent overflow in size calculation for memdup_user()
CVE-2025-38256 io_uring/rsrc: fix folio unpinning
CVE-2025-38263 bcache: fix NULL pointer in cache_set_flush()
CVE-2025-38241 mm/shmem, swap: fix softlockup with mTHP swapin
CVE-2025-38260 btrfs: handle csum tree error with rescue=ibadroots correctly
CVE-2025-38259 ASoC: codecs: wcd9335: Fix missing free of regulator supplies
CVE-2025-38258 mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
CVE-2025-38254 drm/amd/display: Add sanity checks for drm_edid_raw()

Showing top 20 of 26 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38255

No comments yet

Leave a comment