CVE-2025-21773

Summary

CVE-2025-21773: A NULL pointer dereference vulnerability has been identified and addressed in the Linux kernel's etas_es58x driver. The driver mistakenly assumed that the serial number pointer in the udev structure, udev->serial, would never be NULL. An attacker could manipulate the device identity to provide a NULL USB serial number, which would result in a NULL pointer dereference, potentially leading to system instability or crashes. To mitigate this issue, a check has been added to ensure that es58x_dev->udev->serial is not NULL before being accessed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.