Listen to this Post
The vulnerability exists in the Texas Instruments AM65x CPSW NUSS Ethernet driver within the Linux kernel.
For TI System-on-Chips (SoCs) with the CPSW2G instance and a single external Ethernet port, a flaw occurs during the TX (transmit) completion packet handling stage.
When no TX packets have been processed by the driver, the network device pointer (ndev) is accessed without prior initialization.
This ndev pointer remains null under this specific condition.
Accessing a null pointer leads to a dereference operation.
Dereferencing a null pointer in kernel space causes a segmentation fault.
This fault triggers a kernel panic or crash.
The system becomes unresponsive due to the crash.
The issue is tied to the driver’s interrupt handling routine for TX completions.
Upon receiving a TX completion interrupt, the driver attempts to process completed packets.
If the completed packet count is zero, the code path incorrectly assumes ndev is initialized.
The ndev variable is derived from the driver’s private data structure.
However, without prior TX activity, this data may not be set.
The driver fails to check for this state before using ndev.
Consequently, when it tries to access ndev->dev or similar fields, it crashes.
This bug affects systems using the am65-cpsw-nuss driver in specific configurations.
It requires the CPSW2G instance with one external port.
The vulnerability can be triggered by network inactivity or specific driver states.
Fixing it involves adding a check for the number of processed TX packets before accessing ndev.
Platform: Linux kernel
Version: Various kernel versions
Vulnerability: Null pointer dereference
Severity: Critical
Date: 09/19/2025
Prediction: 2025-12-11
What Undercode Say:
Analytics:
Bash commands:
`uname -r`
`lsmod | grep am65`
`dmesg | grep cpsw`
`ip link show`
`ethtool -i eth0`
Codes:
drivers/net/ethernet/ti/am65-cpsw-nuss.c
Check TX completion code.
Look for ndev initialization.
Patch adds packet count check.
How Exploit:
Trigger TX completion interrupt.
Ensure no packets sent.
Cause null pointer access.
System kernel crashes.
Denial of service achieved.
Protection from this CVE Impact:
Update Linux kernel.
Apply official patch.
Disable affected module.
Impact: kernel crash.
System denial-of-service.
Potential device instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
