{"id":"CVE-2025-37860","title":"sfc: fix NULL dereferences in ef100_process_design_param()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix NULL dereferences in ef100_process_design_param()\n\nSince cited commit, ef100_probe_main() and hence also\n ef100_check_design_params() run before efx->net_dev i…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","vendor":"Linux","product":"Linux","affected":["Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < a9703b006a475f474a571801ad3dd9b1bda35273","Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < f21623b8446735b5e2ac5f8ee69b8743177d7b19","Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < e56391011381d6d029da377a65ac314cb3d5def2","Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < 8241ecec1cdc6699ae197d52d58e76bddd995fa5","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-10-01T16:14:46.502915Z"},"published":"2025-04-18","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:36:31.639Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-37860","references":[{"url":"https://git.kernel.org/stable/c/a9703b006a475f474a571801ad3dd9b1bda35273"},{"url":"https://git.kernel.org/stable/c/f21623b8446735b5e2ac5f8ee69b8743177d7b19"},{"url":"https://git.kernel.org/stable/c/e56391011381d6d029da377a65ac314cb3d5def2"},{"url":"https://git.kernel.org/stable/c/8241ecec1cdc6699ae197d52d58e76bddd995fa5"}],"tags":["cve.org"],"epss":0.00315,"epssPercentile":0.24306,"ingestedAt":"2026-10-21T12:48:53.711Z","slug":"CVE-2025-37860","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix NULL dereferences in ef100_process_design_param()\n\nSince cited commit, ef100_probe_main() and hence also\n ef100_check_design_params() run before efx->net_dev is created;\n consequently, we cannot netif_set_tso_max_size() or _segs() at this\n point.\nMove those netif calls to ef100_probe_netdev(), and also replace\n netif_err within the design params code with pci_err.\n\n## Affected\n\n- `Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < a9703b006a475f474a571801ad3dd9b1bda35273`\n- `Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < f21623b8446735b5e2ac5f8ee69b8743177d7b19`\n- `Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < e56391011381d6d029da377a65ac314cb3d5def2`\n- `Linux >= 98ff4c7c8ac7f5339aac6114105395fea19f992e < 8241ecec1cdc6699ae197d52d58e76bddd995fa5`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}