{"id":"CVE-2025-22055","revision":"560b1f692d1d49648065091e3ccce0b6","records":[{"revision":"560b1f692d1d49648065091e3ccce0b6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-22055","aliases":[],"title":"net: fix geneve_opt length integer overflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix geneve_opt length integer overflow\n\nstruct geneve_opt uses 5 bit length for each single option, which\nmeans every vary size option should be smaller than 128 bytes.\n\nHowever, all current related Netlink policies cannot promise this\nlength condition and the attacker can exploit a exact 128-byte size\noption to *fake* a zero length option and confuse the parsing logic,\nfurther achieve heap out-of-bounds read.\n\nOne example crash log is like below:\n\n[    3.905425] ==================================================================\n[    3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0\n[    3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177\n[    3.906646]\n[    3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1\n[    3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n[    3.907784] Call Trace:\n[    3.907925]  <TASK>\n[    3.908048]  dump_stack_lvl+0x44/0x5c\n[    3.908258]  print_report+0x184/0x4be\n[    3.909151]  kasan_report+0xc5/0x100\n[    3.909539]  kasan_check_range+0xf3/0x1a0\n[    3.909794]  memcpy+0x1f/0x60\n[    3.909968]  nla_put+0xa9/0xe0\n[    3.910147]  tunnel_key_dump+0x945/0xba0\n[    3.911536]  tcf_action_dump_1+0x1c1/0x340\n[    3.912436]  tcf_action_dump+0x101/0x180\n[    3.912689]  tcf_exts_dump+0x164/0x1e0\n[    3.912905]  fw_dump+0x18b/0x2d0\n[    3.913483]  tcf_fill_node+0x2ee/0x460\n[    3.914778]  tfilter_notify+0xf4/0x180\n[    3.915208]  tc_new_tfilter+0xd51/0x10d0\n[    3.918615]  rtnetlink_rcv_msg+0x4a2/0x560\n[    3.919118]  netlink_rcv_skb+0xcd/0x200\n[    3.919787]  netlink_unicast+0x395/0x530\n[    3.921032]  netlink_sendmsg+0x3d0/0x6d0\n[    3.921987]  __sock_sendmsg+0x99/0xa0\n[    3.922220]  __sys_sendto+0x1b7/0x240\n[    3.922682]  __x64_sys_sendto+0x72/0x90\n[    3.922906]  do_syscall_64+0x5e/0x90\n[    3.923814]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[    3.924122] RIP: 0033:0x7e83eab84407\n[    3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf\n[    3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c\n[    3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407\n[    3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003\n[    3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c\n[    3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0\n[    3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8\n\nFix these issues by enforing correct length condition in related\npolicies.","state":0,"publishedAt":"2025-04-16T14:12:12.595+00:00","modifiedAt":"2026-10-15T01:05:22.547+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/ip_tunnel_core.c\",\n                        \"net/netfilter/nft_tunnel.c\",\n                        \"net/sched/act_tunnel_key.c\",\n                        \"net/sched/cls_flower.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"a2cb85f989e2074e2f392e00188c438cab3de088\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"b4513ad0f391871d3feee8ddf535609a3aabeeac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"21748669c5825761cbbf47cbeeb01387ddccc8cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"5a2976cc4d9c36ff58a0f10e35ce4283cbaa9c0e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"2952776c69a1a551649ed770bf22e3f691f6ec65\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"738ae5712215fe9181587d582b23333f02c62ca6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"4d606069bdd3c76f8ab1f06796c97ef7f4746807\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ed5269f9e41f495c8e9020c85f5e1644c1afc57\",\n                            \"lessThan\": \"b27055a08ad4b415dcf15b63034f9cb236f7fb40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/ip_tunnel_core.c\",\n                        \"net/netfilter/nft_tunnel.c\",\n                        \"net/sched/act_tunnel_key.c\",\n                        \"net/sched/cls_flower.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.236\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.180\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.134\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.87\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.23\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.11\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14.2\",\n                            \"lessThanOrEqual\": \"6.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/a2cb85f989e2074e2f392e00188c438cab3de088","https://git.kernel.org/stable/c/b4513ad0f391871d3feee8ddf535609a3aabeeac","https://git.kernel.org/stable/c/21748669c5825761cbbf47cbeeb01387ddccc8cb","https://git.kernel.org/stable/c/5a2976cc4d9c36ff58a0f10e35ce4283cbaa9c0e","https://git.kernel.org/stable/c/2952776c69a1a551649ed770bf22e3f691f6ec65","https://git.kernel.org/stable/c/738ae5712215fe9181587d582b23333f02c62ca6","https://git.kernel.org/stable/c/4d606069bdd3c76f8ab1f06796c97ef7f4746807","https://git.kernel.org/stable/c/b27055a08ad4b415dcf15b63034f9cb236f7fb40"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22055","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-22055","identifiers":["CVE-2025-22055"]},"retained":false,"historicalAffected":[]}],"coverage":[]}