GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37784 (GCVE-0-2025-37784)

Vulnerability from cvelistv5 – Published: 2025-05-01 13:07 – Updated: 2026-05-23 15:58
VLAI
Title
net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ti: icss-iep: Fix possible NULL pointer dereference for perout request The ICSS IEP driver tracks perout and pps enable state with flags. Currently when disabling pps and perout signals during icss_iep_exit(), results in NULL pointer dereference for perout. To fix the null pointer dereference issue, the icss_iep_perout_enable_hw function can be modified to directly clear the IEP CMP registers when disabling PPS or PEROUT, without referencing the ptp_perout_request structure, as its contents are irrelevant in this case.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d6b130fabfe197935346fe9f1e50a0947b2b1be7 , < 7891619d21f07a88e0275d6d43db74035aa74f69 (git)
Affected: 4ac8e8bf70b436294534d06e5d500e950e20c13d , < da5035d7aeadcfa44096dd34689bfed6c657f559 (git)
Affected: 9b115361248dc6cce182a2dc030c1c70b0a9639e , < eeec66327001421531b3fb1a2ac32efc8a2493b0 (git)
Affected: 9b115361248dc6cce182a2dc030c1c70b0a9639e , < 7349c9e9979333abfce42da5f9025598083b59c9 (git)
Affected: 6.6.70 , < 6.6.88 (semver)
Affected: 6.12.9 , < 6.12.25 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.6.88 , ≤ 6.6.* (semver)
Unaffected: 6.12.25 , ≤ 6.12.* (semver)
Unaffected: 6.14.4 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/icssg/icss_iep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7891619d21f07a88e0275d6d43db74035aa74f69",
              "status": "affected",
              "version": "d6b130fabfe197935346fe9f1e50a0947b2b1be7",
              "versionType": "git"
            },
            {
              "lessThan": "da5035d7aeadcfa44096dd34689bfed6c657f559",
              "status": "affected",
              "version": "4ac8e8bf70b436294534d06e5d500e950e20c13d",
              "versionType": "git"
            },
            {
              "lessThan": "eeec66327001421531b3fb1a2ac32efc8a2493b0",
              "status": "affected",
              "version": "9b115361248dc6cce182a2dc030c1c70b0a9639e",
              "versionType": "git"
            },
            {
              "lessThan": "7349c9e9979333abfce42da5f9025598083b59c9",
              "status": "affected",
              "version": "9b115361248dc6cce182a2dc030c1c70b0a9639e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.88",
              "status": "affected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.25",
              "status": "affected",
              "version": "6.12.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/icssg/icss_iep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "6.6.70",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "6.12.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icss-iep: Fix possible NULL pointer dereference for perout request\n\nThe ICSS IEP driver tracks perout and pps enable state with flags.\nCurrently when disabling pps and perout signals during icss_iep_exit(),\nresults in NULL pointer dereference for perout.\n\nTo fix the null pointer dereference issue, the icss_iep_perout_enable_hw\nfunction can be modified to directly clear the IEP CMP registers when\ndisabling PPS or PEROUT, without referencing the ptp_perout_request\nstructure, as its contents are irrelevant in this case."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:11.202Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7891619d21f07a88e0275d6d43db74035aa74f69"
        },
        {
          "url": "https://git.kernel.org/stable/c/da5035d7aeadcfa44096dd34689bfed6c657f559"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeec66327001421531b3fb1a2ac32efc8a2493b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7349c9e9979333abfce42da5f9025598083b59c9"
        }
      ],
      "title": "net: ti: icss-iep: Fix possible NULL pointer dereference for perout request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37784",
    "datePublished": "2025-05-01T13:07:20.237Z",
    "dateReserved": "2025-04-16T04:51:23.940Z",
    "dateUpdated": "2026-05-23T15:58:11.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37784",
      "date": "2026-09-16",
      "epss": "0.0018",
      "percentile": "0.07805"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37784\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T14:15:42.770\",\"lastModified\":\"2026-06-17T09:15:26.000\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ti: icss-iep: Fix possible NULL pointer dereference for perout request\\n\\nThe ICSS IEP driver tracks perout and pps enable state with flags.\\nCurrently when disabling pps and perout signals during icss_iep_exit(),\\nresults in NULL pointer dereference for perout.\\n\\nTo fix the null pointer dereference issue, the icss_iep_perout_enable_hw\\nfunction can be modified to directly clear the IEP CMP registers when\\ndisabling PPS or PEROUT, without referencing the ptp_perout_request\\nstructure, as its contents are irrelevant in this case.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ti: icss-iep: Se corrige una posible desreferencia de puntero nulo para la solicitud perout. El controlador IEP de ICSS rastrea el estado de habilitaci\u00f3n de perout y pps mediante indicadores. Actualmente, al deshabilitar las se\u00f1ales pps y perout durante icss_iep_exit(), se produce una desreferencia de puntero nulo para perout. Para solucionar el problema de desreferencia de puntero nulo, se puede modificar la funci\u00f3n icss_iep_perout_enable_hw para borrar directamente los registros CMP de IEP al deshabilitar PPS o PEROUT, sin referenciar la estructura ptp_perout_request, ya que su contenido es irrelevante en este caso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/icssg/icss_iep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d6b130fabfe197935346fe9f1e50a0947b2b1be7\",\"lessThan\":\"7891619d21f07a88e0275d6d43db74035aa74f69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ac8e8bf70b436294534d06e5d500e950e20c13d\",\"lessThan\":\"da5035d7aeadcfa44096dd34689bfed6c657f559\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b115361248dc6cce182a2dc030c1c70b0a9639e\",\"lessThan\":\"eeec66327001421531b3fb1a2ac32efc8a2493b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b115361248dc6cce182a2dc030c1c70b0a9639e\",\"lessThan\":\"7349c9e9979333abfce42da5f9025598083b59c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.70\",\"lessThan\":\"6.6.88\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.9\",\"lessThan\":\"6.12.25\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/ti/icssg/icss_iep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.88\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.25\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.4\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.70\",\"versionEndExcluding\":\"6.6.88\",\"matchCriteriaId\":\"1E963EB3-B495-48C0-A114-F9A9C8AFB092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.9\",\"versionEndExcluding\":\"6.12.25\",\"matchCriteriaId\":\"40ADEF16-E2A9-4B41-B581-49415F42EE52\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.1\",\"versionEndExcluding\":\"6.14.4\",\"matchCriteriaId\":\"1D17AF48-BB59-48A1-B2EE-911CE7FB55B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A3F9505-6B98-4269-8B81-127E55A1BF00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7349c9e9979333abfce42da5f9025598083b59c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7891619d21f07a88e0275d6d43db74035aa74f69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da5035d7aeadcfa44096dd34689bfed6c657f559\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eeec66327001421531b3fb1a2ac32efc8a2493b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:19:16+00:00",
      "cve": "CVE-2025-37784",
      "id": "CVE-2025-37784",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ti: icss-iep: Fix possible NULL pointer dereference for perout request",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37784.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:21:27Z",
      "cve": "CVE-2025-37784",
      "id": "CVE-2025-37784",
      "initial_release_date": "2025-05-02T02:02:24Z",
      "product_status:known_affected": "67",
      "product_status:known_not_affected": "438",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37784",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37784.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.