CVE-2025-22103

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22103

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.

References
Link Resource
https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce Patch
https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836
https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 Patch
https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Nov 2025, 10:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836 -

04 Nov 2025, 17:04

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce - () https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce - Patch
References () https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 - () https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 - Patch
References () https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 - () https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 - Patch
CWE CWE-476
First Time Linux linux Kernel
Linux

09 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 -
References
  • () https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: corregir la desreferencia de puntero nulo en l3mdev_l3_rcv Al eliminar l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s Esto puede causar una desreferencia de puntero nulo: Rastreo de llamada: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 Esto se debe a que l3mdev_l3_rcv() visita Después de ejecutar ipvlan_l3s_unregister(), dev->l3mdev_ops asigna el valor NULL a dev->l3mdev_ops. El proceso es el siguiente: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | Para evitar esto, no configure dev->l3mdev_ops al cancelar el registro de ipvlan l3s.
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: corregir la desreferencia de puntero nulo en l3mdev_l3_rcv Al eliminar l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s Esto puede causar una desreferencia de puntero nulo: Rastreo de llamada: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 Esto se debe a que l3mdev_l3_rcv() visita Después de ejecutar ipvlan_l3s_unregister(), dev->l3mdev_ops asigna el valor NULL a dev->l3mdev_ops. El proceso es el siguiente: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | Para evitar esto, no configure dev->l3mdev_ops al cancelar el registro de ipvlan l3s.

16 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:16

Updated : 2025-11-24 10:15

NVD link : CVE-2025-22103

Mitre link : CVE-2025-22103

CVE.ORG link : CVE-2025-22103

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference