NULL pointer dereference in Linux
CVE-2025-37755
In the Linux kernel, the following vulnerability has been resolved: net: libwx: handle page_pool_dev_alloc_pages error page_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page) but it would still proceed to use the NULL pointer and then crash. This is similar to commit 001ba0902046 ("net: fec: handle page_pool_dev_alloc_pages error"). This is found by our static analysis tool KNighter.
EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions 3c47e8ae113a68da47987750d9896e325d0aeedd, 6.3, 0
- Linux Linux_kernel — versions 6.15
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-37755?
- CVE-2025-37755 is a high-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2025-05-01.
- How severe is CVE-2025-37755?
- High severity. CVSS v3 base score is 7.5 out of 10.