CVE-2025-39814

linux: In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_...

CVE-2025-39814 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2025-39814, released September 16, 2025. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0013
2nd percentile

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when the driver is loaded without RDMA support, will results in a crash as it attempts to remove RDMA's non-existent auxbus device: echo 1 > /sys/class/net/<if>/device/reset BUG: kernel NULL pointer dereference, address: 0000000000000008 ... RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice] ... Call Trace: <TASK> ice_prepare_for_reset+0x77/0x260 [ice] pci_dev_save_and_disable+0x2c/0x70 pci_reset_function+0x88/0x130 reset_store+0x5a/0xa0 kernfs_fop_write_iter+0x15e/0x210 vfs_write+0x273/0x520 ksys_write+0x6b/0xe0 do_syscall_64+0x79/0x3b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but pf->cdev_info will also be NULL, leading to the deref in the trace above. Introduce a flag to be set when the creation of the auxbus device is successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev().

Where it's fixed

ProductFixed inFixReleased
Linux
dtb-aarch64 · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-64kb · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-64kb · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-azure · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-azure · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-default · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-default · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-default-base · opensuse-leap 16.0 6.12.0-160000.26.1.160000.2.7 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-default-base · sles 16.0 6.12.0-160000.26.1.160000.2.7 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-docs · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-docs · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-kvmsmall · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-kvmsmall · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-obs-build · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-obs-qa · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-obs-qa · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-rt · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-source · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-source · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-syms · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-syms · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
kernel-zfcpdump · opensuse-leap 16.0 6.12.0-160000.26.1 OPENSUSE-SU-2026:20287-1 Feb 27, 2026
kernel-zfcpdump · sles 16.0 6.12.0-160000.26.1 SUSE-SU-2026:20599-1 Feb 27, 2026
linux · Debian 14 6.16.5-1 DEBIAN-CVE-2025-39814 Sep 16, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.