CVE-2025-22054

What it actually does

Missing NULL check after devm_kasprintf() in com20020pci_probe() allows NULL pointer dereference on memory allocation failure, leading to kernel panic or crash.

Why it matters to the business

Systems using affected ARCnet PCI hardware may experience unexpected kernel crashes during device initialization under memory pressure, causing downtime and potential data loss until patched kernels are deployed.

How an attack unfolds

An attacker with local access or the ability to induce memory exhaustion during PCI device probing can trigger the unhandled NULL return from devm_kasprintf(), dereferencing it and crashing the kernel; no remote unauthenticated path exists and no public exploits or threat actor campaigns are known.

How to fix it

Update Linux kernel to version 5.4.292 or later, or apply the commit 661cf5d102949898c931e81fd4e1c773afcdeafa; rebuild and reboot with the fixed kernel. For Red Hat rhel_eus 9.2 systems, update libsoup packages to 0:2.72.0-8.el9_2.1.

How to confirm the fix worked

Verify the running kernel version or commit hash matches a fixed release; inspect dmesg or kernel logs for absence of the NULL dereference panic signature in com20020pci_probe after memory-allocation stress tests.

Typical attack path

1. Gain local execution or trigger memory pressure on target system
2. Ensure com20020pci hardware is present so the probe path executes
3. Force devm_kasprintf() to return NULL during probe
4. Kernel dereferences the NULL pointer and panics

How to detect it

Review kernel crash dumps and dmesg for NULL pointer dereference originating in com20020pci_probe(); correlate with low-memory conditions or ARCnet PCI device initialization events; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on systems exposing ARCnet PCI devices
• Monitor EPSS and KEV status for any future increase in exploit activity
• Include the fixed commit in automated kernel build and deployment pipelines
• Test device probe paths under memory pressure before production rollout