Skip to main content

Linux Kernel CVE-2025-71285

| EUVDEUVD-2025-209675 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-7g25-3chf-ppwr
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Boot kernel with affected QRTR driver
  2. Delivery
    MHI stack enables auto_queue for DL channel
  3. Exploit
    MHI invokes dl_callback before QRTR probe completes
  4. Execution
    Callback accesses uninitialized driver structures
  5. Persist
    NULL pointer dereference
  6. Impact
    Kernel panic / denial of service

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the following specific conditions: system must use Qualcomm MHI-based modem communication with QRTR driver enabled (not present on all Linux systems), kernel version must be affected (prior to 6.18.17, 6.19.6, or 7.0), and the attack occurs during driver probe/initialization phase (typically at boot). Local access and low-level privileges are required to trigger the race condition. The vulnerability is deterministic during boot but may also trigger during runtime QRTR reinitalization. Non-affected systems include those without MHI/QRTR drivers loaded (e.g., non-Qualcomm platforms, embedded systems without modems, or systems with userspace modem drivers).
Impact

CVSS 5.5 with attack vector local and privilege level low indicates localized impact with moderate severity. However, EPSS score of 0.02% (4th percentile) strongly suggests this is not widely exploitable in practice and represents a narrow, device-specific issue affecting Qualcomm X1E80100 CRD machines during boot. The attack requires local access and low privileges, distinguishing this from network-exploitable denial of service bugs. The boot-time impact on specific hardware is significant for affected deployments but low for the broader Linux ecosystem. CVSS and EPSS divergence indicates this is a high-CVSS-but-low-real-risk issue: the availability impact is real but confined to a specific SoC variant and initialization pathway. The fix presence as a stable kernel commit confirms this has been addressed and is not a zero-day.
Exploit ScenarioDerived

During Linux kernel boot on a Qualcomm X1E80100 CRD system, the MHI stack initializes the QRTR DL channel and invokes auto_queue, which triggers dl_callback before the QRTR driver probe completes. The callback attempts to dereference uninitialized ring or buffer pointers, causing a NULL pointer dereference and kernel panic. A local user with low privileges (e.g., system daemon) could intentionally trigger the QRTR initialization sequence to reproduce the crash.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Null pointer dereference in the Linux kernel QRTR (Qualcomm IPC Router) driver via MHI auto_queue feature causes denial of service on Qualcomm X1E80100 CRD machines during boot. The vulnerability occurs when the MHI stack invokes the DL (downlink) callback before the QRTR client driver is fully probed, accessing uninitialized driver structures. A local privileged attacker can trigger kernel panic by exploiting the race condition between MHI buffer auto-queuing and driver initialization, affecting systems relying on QRTR over MHI transport.

RemediationAI

Upgrade to patched Linux kernel versions: 6.18.17 or later for 6.18.x, 6.19.6 or later for 6.19.x, or 7.0 for 7.x branches. Apply commits 7bdff9b9b0c65ac7105416fe3a40686832515e20, 8c464e00e0754e016816b1860fa9592dcad80eb2, or 51731792a25cb312ca94cdccfa139eb46de1b2ef depending on kernel branch. For affected Qualcomm X1E80100 CRD devices or similar platforms using QRTR, prioritize kernel updates to resolve boot-time crashes. No workaround exists without the fix since the race condition is inherent to the auto_queue mechanism; devices must update kernel to restore stability. References: https://git.kernel.org/stable/c/7bdff9b9b0c65ac7105416fe3a40686832515e20

Affected VersionsENISA

Linux patch: 0
Linux 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 <51731792a25cb312ca94cdccfa139eb46de1b2ef
Linux 5.17
Linux c682fb70a7dfc25b848a4ff3a385b0471b470606
Linux 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 <7bdff9b9b0c65ac7105416fe3a40686832515e20
Linux patch: 6.18.17
Linux patch: 6.19.6
Linux patch: 7.0
Linux 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 <8c464e00e0754e016816b1860fa9592dcad80eb2

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the QRTR driver's integration with the Modem Host Interface (MHI) stack, which is used for communication with Qualcomm modems. The MHI stack provides an 'auto_queue' feature that automatically queues receive buffers for downlink (DL) channels without requiring explicit management by the client driver. However, this feature introduces a critical race condition: the MHI stack may invoke the dl_callback handler before the QRTR driver completes its probe sequence, at which point internal data structures (rings, callbacks, buffers) are not yet initialized. This leads to CWE-476 (Null Pointer Dereference) when the callback attempts to access these uninitialized pointers. The fix removes the auto_queue mechanism entirely, requiring the QRTR driver to manually manage RX buffer lifecycle during probe and recycle consumed buffers in the dl_callback.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 12, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:32 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels

MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference.

Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot.

So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers.

Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-71285 ADVISORY https://vuldb.com/vuln/361423 REF https://git.kernel.org/stable/c/51731792a25cb312ca94cdccfa139eb46de1b2ef REF https://git.kernel.org/stable/c/7bdff9b9b0c65ac7105416fe3a40686832515e20 REF https://git.kernel.org/stable/c/8c464e00e0754e016816b1860fa9592dcad80eb2 REF https://git.kernel.org/stable/c/8e130ff078892fa5a6bf272ced7565af58d98a85 REF https://git.kernel.org/stable/c/ab0bdaf7a7f4f83b947193563f2a483ab87f72db REF https://git.kernel.org/stable/c/b7874c74bcc224fd586679e51b9ded65f66edc2a

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy