What is CVE-2025-21918?

CVE-2025-21918 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2025-04-01.

How severe is CVE-2025-21918?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2025-21918 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

NULL pointer dereference in Linux

CVE-2025-21918

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them.

EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Linux — versions b9aa02ca39a49740926c2c450a1505a4a0f8954a, 5.16, 0
Linux Linux_kernel — versions 6.14

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

Public proof-of-concept exploits

w4zu/Debian_

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-21918?: CVE-2025-21918 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2025-04-01.
How severe is CVE-2025-21918?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2025-21918 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.