logo_clicknbuy.png

CVE-2025-22017 – Linux kernel devlink XA-Alloc Cyclic Off-by-Error

The following table lists the changes that have been made to the
CVE-2025-22017 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 08, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    devlink: fix xa_alloc_cyclic() error handling

    In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
    be returned, which will cause IS_ERR() to be false. Which can lead to
    dereference not allocated pointer (rel).

    Fix it by checking if err is lower than zero.

    This wasn’t found in real usecase, only noticed. Credit to Pierre.
    Added Reference https://git.kernel.org/stable/c/466132f6d28a7e47a82501fe1c46b8f90487412e
    Added Reference https://git.kernel.org/stable/c/f3b97b7d4bf316c3991e5634c9f4847c2df35478
    Added Reference https://git.kernel.org/stable/c/f8aaa38cfaf6f20afa4db36b6529032fb69165dc
Share the Post:

Related Posts