CVE-2025-39897: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39897 is a NULL pointer dereference vulnerability in the Linux kernel's Xilinx AXI Ethernet (axienet) network driver, caused by missing error handling when retrieving RX metadata pointers. The flaw was published on October 1, 2025, and affects Linux kernel versions 6.8 through 6.12.45 and 6.13 through 6.16.5, as well as release candidates 6.17-rc1 through 6.17-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The dmaengine_desc_get_metadata_ptr() function in the net/ethernet/xilinx/axienet driver can return an error pointer rather than a valid metadata pointer; without proper error checking, subsequent use of this invalid pointer can cause kernel crashes or undefined behavior. Exploitation requires local access with low privileges and no user interaction. The fix adds an IS_ERR() check on the returned pointer, and on failure, unmaps the DMA buffer, frees the socket buffer (skb), and returns early to prevent further processing with invalid data (Feedly, Kernel Patch 1).

Successful exploitation can cause kernel instability or system crashes, resulting in a denial-of-service condition on affected systems. The vulnerability has no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local system running a vulnerable kernel with the Xilinx AXI Ethernet driver active (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

Update to a patched Linux kernel version: 6.12.46 or later for the 6.8–6.12 branch, or 6.16.6 or later for the 6.13–6.16 branch; the fix is also included in the 6.17 stable release. Three upstream kernel patches address this issue (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). Ubuntu has issued security notices USN-8095-1 through USN-8095-5, USN-8100-1, USN-8125-1, and USN-8165-1 addressing this CVE (Ubuntu USN-8095-1). As a workaround where patching is not immediately possible, restrict local system access to minimize the attack surface and avoid loading the xilinx_axienet driver on systems that do not require it.