{"id":"CVE-2025-22050","title":"usbnet:fix NPE during rx_complete","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet:fix NPE during rx_complete\n\nMissing usbnet_going_away Check in Critical Path.\nThe usb_submit_urb function lacks a usbnet_going_away\nvalidation, whereas __usbnet_…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= b80aacfea6e8d6ed6e430aa13922d6ccf044415a < 95789c2f94fd29dce8759f9766baa333f749287c","Linux >= 869caa8de8cb94514df704ccbe0b024fda4b9398 < 0f10f83acfd619e13c64d6705908dfd792f19544","Linux >= 1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce < acacd48a37b52fc95f621765762c04152b58d642","Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < d689645cd1594ea1d13cb0c404f8ad1011353e0e","Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 0c30988588b28393e3e8873d5654f910e86391ba","Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < fd9ee3f0d6a53844f65efde581c91bbb0ff749ac","Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 51de3600093429e3b712e5f091d767babc5dd6df","Linux ca124236cd14e61610f56df9a8f81376a1ffe660","Linux 54671d731f4977fb3c0c26f2840655b5204e4437","Linux >= 5.15.168 < 5.15.180","Linux >= 6.1.113 < 6.1.134","Linux >= 6.6.54 < 6.6.87","Linux >= 6.10.13 < 6.11","Linux >= 6.11.2 < 6.12","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:38:15.922602Z"},"published":"2025-04-16","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:41:49.709Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22050","references":[{"url":"https://git.kernel.org/stable/c/95789c2f94fd29dce8759f9766baa333f749287c"},{"url":"https://git.kernel.org/stable/c/0f10f83acfd619e13c64d6705908dfd792f19544"},{"url":"https://git.kernel.org/stable/c/acacd48a37b52fc95f621765762c04152b58d642"},{"url":"https://git.kernel.org/stable/c/d689645cd1594ea1d13cb0c404f8ad1011353e0e"},{"url":"https://git.kernel.org/stable/c/0c30988588b28393e3e8873d5654f910e86391ba"},{"url":"https://git.kernel.org/stable/c/fd9ee3f0d6a53844f65efde581c91bbb0ff749ac"},{"url":"https://git.kernel.org/stable/c/51de3600093429e3b712e5f091d767babc5dd6df"}],"tags":["cve.org"],"epss":0.00196,"epssPercentile":0.0938,"ingestedAt":"2026-11-05T22:38:31.859Z","slug":"CVE-2025-22050","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusbnet:fix NPE during rx_complete\n\nMissing usbnet_going_away Check in Critical Path.\nThe usb_submit_urb function lacks a usbnet_going_away\nvalidation, whereas __usbnet_queue_skb includes this check.\n\nThis inconsistency creates a race condition where:\nA URB request may succeed, but the corresponding SKB data\nfails to be queued.\n\nSubsequent processes:\n(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))\nattempt to access skb->next, triggering a NULL pointer\ndereference (Kernel Panic).\n\n## Affected\n\n- `Linux >= b80aacfea6e8d6ed6e430aa13922d6ccf044415a < 95789c2f94fd29dce8759f9766baa333f749287c`\n- `Linux >= 869caa8de8cb94514df704ccbe0b024fda4b9398 < 0f10f83acfd619e13c64d6705908dfd792f19544`\n- `Linux >= 1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce < acacd48a37b52fc95f621765762c04152b58d642`\n- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < d689645cd1594ea1d13cb0c404f8ad1011353e0e`\n- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 0c30988588b28393e3e8873d5654f910e86391ba`\n- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < fd9ee3f0d6a53844f65efde581c91bbb0ff749ac`\n- `Linux >= 04e906839a053f092ef53f4fb2d610983412b904 < 51de3600093429e3b712e5f091d767babc5dd6df`\n- `Linux ca124236cd14e61610f56df9a8f81376a1ffe660`\n- `Linux 54671d731f4977fb3c0c26f2840655b5204e4437`\n- `Linux >= 5.15.168 < 5.15.180`\n- `Linux >= 6.1.113 < 6.1.134`\n- `Linux >= 6.6.54 < 6.6.87`\n- `Linux >= 6.10.13 < 6.11`\n- `Linux >= 6.11.2 < 6.12`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}