CVE-2025-21676

What it actually does

NULL pointer dereference in fec_enet_update_cbd when page_pool_dev_alloc_pages returns NULL under memory pressure, causing kernel crash instead of graceful packet drop.

Why it matters to the business

Unexpected system reboots or hangs on Linux systems using the FEC Ethernet driver during memory pressure, disrupting network connectivity and workloads on affected hardware such as embedded devices.

How an attack unfolds

An attacker or workload induces memory pressure on a system running the vulnerable FEC driver; the driver attempts page allocation, receives NULL, ignores the failure, and dereferences the pointer leading to a crash. No remote unauthenticated exploitation path exists.

How to fix it

Update the Linux kernel to a version containing commit 8a0097db0544b658c159ac787319737712063a23 which adds proper NULL handling and drops the packet on allocation failure.

How to confirm the fix worked

Verify the running kernel contains commit 8a0097db0544b658c159ac787319737712063a23 or later equivalent stable backport; confirm no WARN_ON or crash occurs under simulated memory pressure with FEC traffic.

Typical attack path

1. Gain local code execution or trigger memory exhaustion conditions on target system
2. Force network traffic through FEC interface while memory is low
3. Trigger page_pool_dev_alloc_pages failure path in fec_enet_update_cbd
4. Kernel panics due to NULL dereference

How to detect it

Inspect kernel logs for oops/panic entries mentioning fec_enet_update_cbd, page_pool_dev_alloc_pages, or NULL pointer dereference in the FEC driver during periods of high memory usage.

• fec_enet_update_cbd
• page_pool_dev_alloc_pages
• WARN_ON(!new_page)

What your security team should do

• Prioritize kernel upgrade on systems using FEC Ethernet (imx6 and similar) within normal patching cycles
• Increase vm.min_free_kbytes as a temporary mitigation on affected devices
• Monitor for kernel oops or panic logs referencing fec or page_pool under memory pressure