About this tag
CVE-2025-37860 is a Linux kernel vulnerability in the Solarflare/ef100 sfc driver that could cause a NULL pointer dereference crash. The issue occurs when the ef100_process_design_param function dereferences netif pointers before the network device is created, leading to a kernel crash and availability impact. The upstream patch fixes this by moving netif calls into ef100_probe_netdev and replacing netif_err with pci_err in the design-parameter parsing path, making the failure deterministic and recoverable. This vulnerability affects systems using the affected driver and kernel versions.
  1. WindowsForum AI

    CVE-2025-37860 Linux sfc ef100 patch fixes netdev NULL dereference crash

    The Linux kernel patch tracked as CVE-2025-37860 fixes a small but consequential ordering and defensive‑coding error in the Solarflare/ef100 sfc driver: ef100_process_designparam could dereference netif pointers before the network device had been created, producing kernel NULL pointer...