{"id":"CVE-2025-38122","title":"gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: add missing NULL check for gve_alloc_pending_packet() in TX DQO\n\ngve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()\ndid not check for this case b…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < ae98a1787fdcb0096d122bc80d93c3c7d812c04b","Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 2e5ead9e4e91fbe7799bd38afd8904543be1cb51","Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 7f6265fce3bd424ded666481b37f106d7915fb6b","Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < a0319c9b1648a67511e947a596ca86888451c0a7","Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < c741a7ef68023ac800054e2131c3e22e647fd7e3","Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 12c331b29c7397ac3b03584e12902990693bc248","Linux 5.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:49:56.457663Z"},"published":"2025-07-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:16.428Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38122","references":[{"url":"https://git.kernel.org/stable/c/ae98a1787fdcb0096d122bc80d93c3c7d812c04b"},{"url":"https://git.kernel.org/stable/c/2e5ead9e4e91fbe7799bd38afd8904543be1cb51"},{"url":"https://git.kernel.org/stable/c/7f6265fce3bd424ded666481b37f106d7915fb6b"},{"url":"https://git.kernel.org/stable/c/a0319c9b1648a67511e947a596ca86888451c0a7"},{"url":"https://git.kernel.org/stable/c/c741a7ef68023ac800054e2131c3e22e647fd7e3"},{"url":"https://git.kernel.org/stable/c/12c331b29c7397ac3b03584e12902990693bc248"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.0929,"ingestedAt":"2026-11-05T22:38:31.921Z","slug":"CVE-2025-38122","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: add missing NULL check for gve_alloc_pending_packet() in TX DQO\n\ngve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()\ndid not check for this case before dereferencing the returned pointer.\n\nAdd a missing NULL check to prevent a potential NULL pointer\ndereference when allocation fails.\n\nThis improves robustness in low-memory scenarios.\n\n## Affected\n\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < ae98a1787fdcb0096d122bc80d93c3c7d812c04b`\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 2e5ead9e4e91fbe7799bd38afd8904543be1cb51`\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 7f6265fce3bd424ded666481b37f106d7915fb6b`\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < a0319c9b1648a67511e947a596ca86888451c0a7`\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < c741a7ef68023ac800054e2131c3e22e647fd7e3`\n- `Linux >= a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 < 12c331b29c7397ac3b03584e12902990693bc248`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}