CVE-2025-21904 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2025-21904?

CVE-2025-21904 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's caif_virtio driver could cause kernel crashes or denial of service. The issue occurs when the cfv_probe() function incorrectly checks cfv->vdev instead of cfv->vq_tx before calling del_vqs(). This affects systems using the caif_virtio driver for communication over virtualized channels.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's caif_virtio driver could cause kernel crashes or denial of service. The issue occurs when the cfv_probe() function incorrectly checks cfv->vdev instead of cfv->vq_tx before calling del_vqs(). This affects systems using the caif_virtio driver for communication over virtualized channels.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions containing the vulnerable caif_virtio driver code prior to fixes in stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if the caif_virtio driver is loaded and used. Many systems may not use this driver by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and complete denial of service, requiring physical or remote reboot.

🟠

Likely Case

Local denial of service through kernel crash when the vulnerable code path is triggered during driver operations.

🟢

If Mitigated

No impact if the vulnerable driver is not loaded or the specific code path isn't triggered.

🌐 Internet-Facing: LOW - Requires local access or ability to trigger the vulnerable driver code path.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger the vulnerability to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the specific code path in cfv_probe() with the right conditions to cause the NULL pointer dereference.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commit hashes provided in references

Vendor Advisory: https://git.kernel.org/stable/c/29e0cd296c87240278e2f7ea4cf3f496b60c03af

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the kernel version after reboot.

🔧 Temporary Workarounds

Disable caif_virtio driver

linux

Prevent loading of the vulnerable driver module

echo 'blacklist caif_virtio' >> /etc/modprobe.d/blacklist-caif_virtio.conf
rmmod caif_virtio

🧯 If You Can't Patch

Ensure the caif_virtio driver is not loaded or in use on critical systems
Implement strict access controls to prevent local users from triggering the vulnerable code path

🔍 How to Verify

Check if Vulnerable:

Check if caif_virtio module is loaded: lsmod | grep caif_virtio. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to a version containing the fix commits, and the caif_virtio module loads without issues.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in kernel logs
System crash/reboot events

Network Indicators:

Unusual system reboots of Linux servers

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "caif_virtio" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-21904

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.11% exploit probability (29.1th percentile)

Published: April 1, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21904, you might also want to check these: