Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2025-21649

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so t…

Published Jan 19, 2025CWE-476EPSS 0.21%

Overview

CVE-2025-21649 is a medium-severity vulnerability. It was published on January 19, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when 1588 is sent on HIP08 devices

Currently, HIP08 devices does not register the ptp devices, so the

hdev->ptp is NULL. But the tx process would still try to set hardware time

stamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash.

[ 128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018

...

[ 128.280251] pc : hclge_ptp_set_tx_info+0x2c/0x140 [hclge]

[ 128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge]

[ 128.292938] sp : ffff800059b93140

[ 128.297200] x29: ffff800059b93140 x28: 0000000000003280

[ 128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080

[ 128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001

[ 128.315969] x23: 0000000000000000 x22: 0000000000000194

[ 128.322219] x21: ffff0cd94f986000 x20: 0000000000000000

[ 128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000

[ 128.334698] x17: 0000000000000000 x16: ff

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/9741e72b2286de8b38de9db685588ac421a95c87Refgit.kernel.org/stable/c/f19ab3ef96d9626e5f1bdc56d3574c355e83d623

How CyberStrike helps

Frequently asked questions

What is CVE-2025-21649?

CVE-2025-21649 is a medium-severity vulnerability. It was published on January 19, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-21649?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2025-21649?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2025-21649?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2025-21649 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2025

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999