CVE-2025-22103

net: fix NULL pointer dereference in l3mdev_l3_rcv

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2025-22103

Published

In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-22103

Published

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ipvlan/ipvlan_l3s.c"
                    ],
                    "versions": [
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "1da52878f7fb74ace304f74325bb89e3e5546b55",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "d97d6b1bd2b7f2a188d261d44c4519a13b8c406a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "52b44d8c653459c658b733d13658afdde45f6836",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "59599bce44af3df7a215ebc81cb166426e1c9204",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "f9dff65140efc289f01bcf39c3ca66a8806b6132",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "c675e06a98a474f7ad0af32ce467613da818da52",
                            "lessThan": "0032c99e83b9ce6d5995d65900aa4b6ffb501cce",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                }

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ipvlan/ipvlan_l3s.c"
                    ],
                    "versions": [
                        {
                            "version": "5.1",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.1",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.270",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.221",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.188",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.117",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.46",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14.2",
                            "lessThanOrEqual": "6.14.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON