CVE-2025-21723

What it actually does

Incorrect non-NULL assignment to bsg_queue on bsg_setup_queue() failure bypasses the null check in mpi3mr_bsg_exit(), resulting in a NULL pointer dereference during driver removal and a kernel crash.

Why it matters to the business

Unexpected system crashes and potential data loss or downtime on systems using the affected storage controller driver; low exploitability reduces immediate risk but still requires patching for stability.

How an attack unfolds

An attacker with local access triggers a failure path during BSG queue setup in the mpi3mr driver, leaving the queue pointer in an inconsistent state; subsequent driver unload during device removal then dereferences a null pointer, crashing the kernel.

How to fix it

Update the Linux kernel to a version containing commit 19b248069d1b1424982723a2bf3941ad864d5204 or later; no specific mitigation is documented beyond patching.

How to confirm the fix worked

Confirm the kernel source includes the fix commit; test driver load/unload paths under simulated bsg_setup failure to ensure no crash occurs.

Typical attack path

1. Obtain local access to a system with the mpi3mr driver loaded
2. Trigger bsg_setup_queue() failure condition
3. Initiate device removal or module unload to invoke mpi3mr_bsg_exit()
4. Cause kernel NULL pointer dereference and crash

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference traces containing mpi3mr_bsg_exit and mpi3mr_remove; correlate with device removal events.

What your security team should do

• Prioritize kernel updates on systems using mpi3mr hardware
• Monitor for kernel oops or NULL dereference logs involving mpi3mr_bsg_exit
• Review EPSS trend and absence from KEV to schedule within normal patching windows