NULL Pointer Dereference Affecting kernel-modules-extra-common package, versions <0:6.12.25-32.101.amzn2023


Severity

Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.06% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-AMZN2023-KERNELMODULESEXTRACOMMON-10496975
  • published24 Jun 2025
  • disclosed1 May 2025

Introduced: 1 May 2025

CVE-2025-23147  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-modules-extra-common to version 0:6.12.25-32.101.amzn2023 or higher.
This issue was patched in ALAS2023-2025-995.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-modules-extra-common package and not the kernel-modules-extra-common package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

i3c: Add NULL pointer check in i3c_master_queue_ibi()

The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls i3c_master_queue_ibi() to queue an IBI work task, leading to "Unable to handle kernel read from unreadable memory" and resulting in a kernel panic.

Typical IBI handling flow:

  1. The I3C master scans target devices and probes their respective drivers.
  2. The target device driver calls i3c_device_request_ibi() to enable IBI and assigns dev-&gt;ibi = ibi.
  3. The I3C master receives an IBI from the target device and calls i3c_master_queue_ibi() to queue the target device driver’s IBI handler task.

However, since target device events are asynchronous to the I3C probe sequence, step 3 may occur before step 2, causing dev-&gt;ibi to be NULL, leading to a kernel panic.

Add a NULL pointer check in i3c_master_queue_ibi() to prevent accessing an uninitialized dev-&gt;ibi, ensuring stability.

CVSS Base Scores

version 3.1