CVE-2025-37787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered

Russell King reports that a system with mv88e6xxx dereferences a NULL

pointer when unbinding this driver:

https://lore.kernel.org/netdev/[email protected]/

The crash seems to be in devlink_region_destroy(), which is not NULL

tolerant but is given a NULL devlink global region pointer.

At least on some chips, some devlink regions are conditionally registered

since the blamed commit, see mv88e6xxx_setup_devlink_regions_global():

if (cond && !cond(chip))

continue;

These are MV88E6XXX_REGION_STU and MV88E6XXX_REGION_PVT. If the chip

does not have an STU or PVT, it should crash like this.

To fix the issue, avoid unregistering those regions which are NULL, i.e.

were skipped at mv88e6xxx_setup_devlink_regions_global() time.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References