CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv
In the Linux kernel, the following vulnerability has been resolved:
net: fix NULL pointer dereference in l3mdevl3rcv
When delete l3s ipvlan:
ip link del link eth0 ipvlan1 type ipvlan mode l3s
This may cause a null pointer dereference:
Call trace: iprcvfinish+0x48/0xd0 iprcv+0x5c/0x100 netifreceiveskbonecore+0x64/0xb0 netifreceiveskb+0x20/0x80 processbacklog+0xb4/0x204 napipoll+0xe8/0x294 netrxaction+0xd8/0x22c dosoftirq+0x12c/0x354
This is because l3mdevl3rcv() visit dev->l3mdevops after ipvlanl3sunregister() assign the dev->l3mdevops to NULL. The process like this:
(CPU1) | (CPU2) l3mdevl3rcv() | check dev->privflags: | master = skb->dev; | | | ipvlanl3sunregister() | set dev->privflags | dev->l3mdevops = NULL; | visit master->l3mdevops |
To avoid this by do not set dev->l3mdevops when unregister l3s ipvlan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.117.1-1 - Configuration
Apply the kernel fix for “net: fix NULL pointer dereference in l3mdev_l3_rcv” so that l3mdev_l3_rcv() does not dereference dev->l3mdev_ops after ipvlan_l3s_unregister() sets dev->l3mdev_ops to NULL (e.g., avoid visiting dev->l3mdev_ops when unregistering l3s ipvlan).
Linux kernel (ipvlan l3s) dev->l3mdev_ops handling during unregister = do not leave dev->l3mdev_ops set after unregister; ensure it is not dereferenced when NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22103?
CVE-2025-22103 has a moderate severity level due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2025-22103?
To fix CVE-2025-22103, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2025-22103?
CVE-2025-22103 affects the Linux kernel, specifically when using the l3s ipvlan mode.
What is the potential impact of CVE-2025-22103?
The potential impact of CVE-2025-22103 includes a system crash due to a NULL pointer dereference when deleting certain network interfaces.
When was CVE-2025-22103 disclosed?
CVE-2025-22103 was disclosed as a vulnerability that has been resolved in the Linux kernel kernel.