CVE-2025-21755

Summary

CVE-2025-21755 is a vulnerability affecting the Linux kernel where a null pointer dereference occurs during socket release. Specifically, the function sock_orphan() sets sk->sk_wq to NULL, but if SO_LINGER is enabled, this leads to a null pointer dereference in virtio_transport_wait_close(). To mitigate this issue, the socket should only be orphaned after transport release. This vulnerability partially reverses a previous fix and was detected by KASAN, causing a null-ptr dereference in the range of [0x0000000000000018-0x000000000000001f]. The affected functions include lock_acquire, _raw_spin_lock_irqsave, add_wait_queue, virtio_transport_release, __vsock_release, vsock_release, __sock_release, and sock_close.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.