Security tracker / CVE-2025-37860

CVE-2025-37860

sfc: fix NULL dereferences in ef100_process_design_param()

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 98ff4c7c8ac7 ("sfc: Separate netdev probe/remove from PCI
 carnil> probe/remove"). Vulnerable versions: 6.0.

Bugs

Status

Branch	Status
upstream	released (6.15-rc1) [8241ecec1cdc6699ae197d52d58e76bddd995fa5]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.14-upstream-stable	released (6.14.2) [e56391011381d6d029da377a65ac314cb3d5def2]
6.12-upstream-stable	released (6.12.57) [f21623b8446735b5e2ac5f8ee69b8743177d7b19]
6.6-upstream-stable	needed
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.16.3-1)
6.12-trixie-security	released (6.12.57-1)
6.1-bookworm-security	needed
5.10-bullseye-security	N/A "Vulnerable code not present"