CVE-2025-40264

In the Linux kernel's be2net driver, a NULL pointer dereference vulnerability affects the processing of packets sent to the Baseboard Management Controller (BMC). The function be_insert_vlan_in_pkt() is called with a NULL wrb_params argument at the be_send_pkt_to_bmc() call site, which may lead to a NULL pointer dereference when handling a workaround for a specific IPv6 packet [1].

To exploit this vulnerability, an attacker needs to trigger the specific packet condition that invokes the workaround path. This could potentially be achieved by sending crafted network packets to the system, though the exact prerequisites are not detailed. The issue does not require authentication if the attacker can control network traffic reaching the affected driver [1].

A successful exploitation could cause a kernel NULL pointer dereference, leading to a system crash or denial of service. No further impact such as code execution is described in the source [1].

The vulnerability is fixed in updated Linux kernel stable releases. The commit referenced addresses the issue by ensuring wrb_params is properly passed from be_xmit(). System administrators should apply the latest kernel updates to mitigate this vulnerability [1].