CVE-2025-68220

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error

Make knav_dma_open_channel consistently return NULL on error instead

of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h

returns NULL when the driver is disabled, but the driver

implementation does not even return NULL or ERR_PTR on failure,

causing inconsistency in the users. This results in a crash in

netcp_free_navigator_resources as followed (trimmed):

Unhandled fault: alignment exception (0x221) at 0xfffffff2

[fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000

Internal error: : 221 [#1] SMP ARM

Modules linked in:

CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE

Hardware name: Keystone

PC is at knav_dma_close_channel+0x30/0x19c

LR is at netcp_free_navigator_resources+0x2c/0x28c

[... TRIM...]

Call trace:

knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c

netcp_free_n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References