CVE-2025-68213

kernel: idpf: fix possible vport_config NULL pointer deref in remove

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · December 16, 2025

Updated · June 30, 2026

Description

A null pointer dereference was found in the Intel IDPF network driver in the Linux kernel. When a vport fails to initialize (e.g., during VF creation timeout), attempting to remove the driver crashes because idpf_remove() dereferences vport_config without checking for NULL.

Statement

This affects Intel Infrastructure Data Path Function (IDPF) devices, typically used in data center environments. The crash occurs only after initialization failures followed by driver removal.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 · NULL Pointer Dereference