CVE-2025-22065

What it actually does

NULL pointer dereference in idpf_remove during double invocation of the remove path when SRIOV is enabled, triggered because idpf_shutdown calls the full remove routine which then invokes sriov_disable and re-enters the same code with a now-NULL adapter pointer.

Why it matters to the business

Reboot or shutdown of systems using the affected driver with SRIOV configured can cause an immediate kernel crash, leading to unplanned downtime and potential loss of in-flight network state for virtual functions.

How an attack unfolds

An attacker or automated process enables SRIOV on an idpf interface, then triggers a system reboot; the shutdown sequence calls idpf_shutdown which directly invokes idpf_remove, after which sriov_disable re-invokes the same routine on a NULL adapter, producing the dereference.

How to fix it

Update to a kernel containing commit 79618e952ef4dfa1a17ee0631d5549603fab58d8 or apply the Red Hat edk2 package updates to version 0:20231122-6.el9_4.6 (or later) for all listed edk2 components on RHEL 9.4 EUS; replace the direct idpf_remove call in idpf_shutdown with idpf_vc_core_deinit plus idpf_deinit_dflt_mbx.

How to confirm the fix worked

Confirm the running kernel contains commit 79618e952ef4dfa1a17ee0631d5549603fab58d8; attempt the SRIOV enable + reboot sequence in a test environment and verify absence of the NULL dereference oops; check package versions match the fixed edk2 releases.

Typical attack path

1. Enable SRIOV via sysfs (echo 1 > /sys/class/net/<netif>/device/sriov_numvfs)
2. Initiate system reboot or shutdown
3. Kernel executes idpf_shutdown which calls idpf_remove
4. idpf_remove calls sriov_disable which re-enters idpf_remove with adapter already freed
5. NULL pointer dereference occurs at idpf_remove+0x22

How to detect it

Search kernel logs and dmesg for the exact BUG string "kernel NULL pointer dereference" combined with RIP idpf_remove and the call trace containing idpf_shutdown and sriov_disable; examine crash dumps for adapter pointer at offset 0x20.

• RIP: 0010:idpf_remove+0x22/0x1f0 [idpf]
• idpf_shutdown+0x12/0x30 [idpf]
• sriov_disable+0x34/0xe0
• BUG: kernel NULL pointer dereference, address: 0000000000000020

What your security team should do

• Prioritize patching systems that use idpf with SRIOV enabled within the next maintenance window
• Apply the exact fixed package versions listed for edk2 on RHEL 9.4 EUS or the upstream commit
• Test reboot behavior on representative hardware before broad rollout
• Monitor kernel logs for idpf_remove NULL dereference signatures until patches are deployed