CVE-2025-22033— arm64: Don't call NULL in do_compat_alignment_fixup()
Affected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< cf187601053ecaf671ae645edb898901f81d03e9 | affected |
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< 617a4b0084a547917669fef2b54253cc9c064990 | affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< 2df8ee605eb6806cd41c2095306db05206633a08 | affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< fa2a9f625f185c6acb4ee5be8d71359a567afac9 | affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< ecf798573bbe0805803f7764e12a34b4bcc65074 | affected | ||
3fc24ef32d3b9368f4c103dcd21d6a3f959b4870< c28f31deeacda307acfee2f18c0ad904e5123aac | affected | ||
6.1 | affected | ||
< 6.1 | unaffected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-22033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
arm64: Don't call NULL in do_compat_alignment_fixup()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that's the case, signal to the caller that it needs to proceed with the regular alignment fault handling (i.e. SIGBUS). Without this patch, the kernel panics: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000 [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000 Internal error: Oops: 0000000086000006 [#1] SMP Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa> libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c> CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1 Debian 6.1.128-1 Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : do_compat_alignment_fixup+0xd8/0x3dc sp : ffff80000f973dd0 x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001 x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000 x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001 Call trace: 0x0 do_alignment_fault+0x40/0x50 do_mem_abort+0x4c/0xa0 el0_da+0x48/0xf0 el0t_32_sync_handler+0x110/0x140 el0t_32_sync+0x190/0x194 Code: bad PC value ---[ end trace 0000000000000000 ]---
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64兼容对齐修复空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-22033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-22033
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total
| CVE-2025-22040 | 8.8 HIGH | ksmbd: fix session use-after-free in multichannel connection |
| CVE-2025-22041 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_sessions_deregister() |
| CVE-2025-22093 | drm/amd/display: avoid NPD when ASIC does not support DMUB | |
| CVE-2025-22107 | net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() | |
| CVE-2025-22106 | vmxnet3: unregister xdp rxq info in the reset path | |
| CVE-2025-22105 | bonding: check xdp prog when set bond mode | |
| CVE-2025-22104 | ibmvnic: Use kernel helpers for hex dumps | |
| CVE-2025-22103 | net: fix NULL pointer dereference in l3mdev_l3_rcv | |
| CVE-2025-22102 | Bluetooth: btnxpuart: Fix kernel panic during FW release | |
| CVE-2025-22100 | drm/panthor: Fix race condition when gathering fdinfo group samples | |
| CVE-2025-22101 | net: libwx: fix Tx L4 checksum | |
| CVE-2025-22099 | drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init | |
| CVE-2025-22097 | drm/vkms: Fix use after free and double free on init error | |
| CVE-2025-22098 | drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set() | |
| CVE-2025-22096 | drm/msm/gem: Fix error code msm_parse_deps() | |
| CVE-2025-22095 | PCI: brcmstb: Fix error path after a call to regulator_bulk_get() | |
| CVE-2025-22094 | powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' | |
| CVE-2025-22083 | vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint | |
| CVE-2025-22082 | iio: backend: make sure to NULL terminate stack buffer | |
| CVE-2025-22081 | fs/ntfs3: Fix a couple integer overflows on 32bit systems |
Showing top 20 of 127 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2025-22033
No comments yet