---
id: CVE-2025-22017
title: 'devlink: fix xa_alloc_cyclic() error handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  devlink: fix xa_alloc_cyclic() error handling

  In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
  be returned, which will cause IS_ERR() to be fal…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 <
    f8aaa38cfaf6f20afa4db36b6529032fb69165dc
  - >-
    Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 <
    466132f6d28a7e47a82501fe1c46b8f90487412e
  - >-
    Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 <
    f3b97b7d4bf316c3991e5634c9f4847c2df35478
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:38:09.974516Z'
published: '2025-04-08'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:49.522Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22017'
references:
  - url: 'https://git.kernel.org/stable/c/f8aaa38cfaf6f20afa4db36b6529032fb69165dc'
  - url: 'https://git.kernel.org/stable/c/466132f6d28a7e47a82501fe1c46b8f90487412e'
  - url: 'https://git.kernel.org/stable/c/f3b97b7d4bf316c3991e5634c9f4847c2df35478'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.09785
ingestedAt: '2026-11-05T22:38:31.859Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

devlink: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
be returned, which will cause IS_ERR() to be false. Which can lead to
dereference not allocated pointer (rel).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

## Affected

- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < f8aaa38cfaf6f20afa4db36b6529032fb69165dc`
- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 466132f6d28a7e47a82501fe1c46b8f90487412e`
- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < f3b97b7d4bf316c3991e5634c9f4847c2df35478`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.