What’s Vulnerable › Vulnerabilities

CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-01 · updated 2026-10-19
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails. Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data.

Affected products

• Linux kernel: from 6.8 before 6.12.46; from 6.13 before 6.16.6; 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4 — fixed in 6.12.46, 6.16.6

How to fix

Upgrade to a fixed version: Linux kernel 6.12.46, 6.16.6. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/8bbceba7dc5090c00105e006ce28d1292cfda8dd
• https://git.kernel.org/stable/c/92e2fc92bc4eb2bc0e84404316fbc02ddd0a3196
• https://git.kernel.org/stable/c/d0ecda6fdd840b406df6617b003b036f65dd8926

Get alerted when CVE-2025-39897 or the next vulnerability affects your stack