CVE-2025-21980

Summary

CVE-2025-21980 is a newly identified vulnerability in the Linux kernel. It involves a potential NULL pointer dereference in the GRED scheduler. If kzalloc in gred_init returns a NULL pointer, the error handling path is followed, leading to the invocation of gred_destroy and subsequently gred_offload. In certain conditions, memset in gred_offload may receive a NULL pointer as input, resulting in a kernel crash. This issue affects the scheduling component of the network stack and could potentially be exploited to cause denial of service or gain unauthorized access. The vulnerability is resolved by ensuring that ->ndo_setup_tc() is only called when table->opt is not NULL in gred_init().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.