CVE-2025-40264

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states. The correct way would be to pass the wrb_params from be_xmit().

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/012ee5882b1830db469194466a210768ed207388
https://git.kernel.org/stable/c/1ecd86ec6efddb59a10c927e8e679f183bb9113e
https://git.kernel.org/stable/c/48d59b60dd5d7e4c48c077a2008c9dcd7b59bdfe
https://git.kernel.org/stable/c/4c4741f6e7f2fa4e1486cb61e1c15b9236ec134d
https://git.kernel.org/stable/c/630360c6724e27f1aa494ba3fffe1e38c4205284
https://git.kernel.org/stable/c/7d277a7a58578dd62fd546ddaef459ec24ccae36
https://git.kernel.org/stable/c/ce0a3699244aca3acb659f143c9cb1327b210f89
https://git.kernel.org/stable/c/f499dfa5c98e92e72dd454eb95a1000a448f3405
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-04 16:16

Updated : 2026-06-17 09:21

NVD link : CVE-2025-40264

Mitre link : CVE-2025-40264

CVE.ORG link : CVE-2025-40264

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-40264", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "48d59b60dd5d7e4c48c077a2008c9dcd7b59bdfe", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "f499dfa5c98e92e72dd454eb95a1000a448f3405", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "630360c6724e27f1aa494ba3fffe1e38c4205284", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "012ee5882b1830db469194466a210768ed207388", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "ce0a3699244aca3acb659f143c9cb1327b210f89", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "1ecd86ec6efddb59a10c927e8e679f183bb9113e", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "4c4741f6e7f2fa4e1486cb61e1c15b9236ec134d", "versionType": "git"}, {"status": "affected", "version": "760c295e0e8d982917d004c9095cff61c0cbd803", "lessThan": "7d277a7a58578dd62fd546ddaef459ec24ccae36", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/emulex/benet/be_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.302", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.247", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.118", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.60", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/emulex/benet/be_main.c"], "defaultStatus": "affected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-12-04T16:16:20.510", "references": [{"url": "https://git.kernel.org/stable/c/012ee5882b1830db469194466a210768ed207388", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1ecd86ec6efddb59a10c927e8e679f183bb9113e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/48d59b60dd5d7e4c48c077a2008c9dcd7b59bdfe", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c4741f6e7f2fa4e1486cb61e1c15b9236ec134d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/630360c6724e27f1aa494ba3fffe1e38c4205284", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7d277a7a58578dd62fd546ddaef459ec24ccae36", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ce0a3699244aca3acb659f143c9cb1327b210f89", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f499dfa5c98e92e72dd454eb95a1000a448f3405", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: pass wrb_params in case of OS2BMC\n\nbe_insert_vlan_in_pkt() is called with the wrb_params argument being NULL\nat be_send_pkt_to_bmc() call site.\u00a0 This may lead to dereferencing a NULL\npointer when processing a workaround for specific packet, as commit\nbc0c3405abbb (\"be2net: fix a Tx stall bug caused by a specific ipv6\npacket\") states.\n\nThe correct way would be to pass the wrb_params from be_xmit()."}], "lastModified": "2026-06-17T09:21:33.433", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}