CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
calipso: Fix null-ptr-deref in calipsoreq{set,del}attr().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 3b24d854cb35 - Configuration
Modify calipso_req_setattr() and calipso_req_delattr() to return an error to prevent the null-ptr-deref in calipso_req_{set,del}attr() (net/ipv6/calipso.c:1204).
Linux kernel (CALIPSO / netlabel) calipso_req_setattr() and calipso_req_delattr() behavior = Return an error - Compensating control
Rely on SYN Cookie behavior so that request_sock->rsk_listener may be NULL without triggering the calipso_req_{set,del}attr() null-ptr-deref (the crash occurs when SYN Cookie is returned and reqsk->rsk_listener could be NULL).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38181?
CVE-2025-38181 has been classified with a severity level that indicates a potential impact on system stability due to a null pointer dereference.
How do I fix CVE-2025-38181?
To fix CVE-2025-38181, update your Linux kernel to the latest patched version that addresses the null pointer dereference in calipso_req_{set,del}attr().
What systems are affected by CVE-2025-38181?
CVE-2025-38181 affects various versions of the Linux kernel used in multiple Linux distributions.
What causes the vulnerability in CVE-2025-38181?
CVE-2025-38181 is caused by a null pointer dereference occurring in the allocation of a CALIPSO option when processing socket operations.
Is there a mitigation for CVE-2025-38181 if I cannot update?
If immediate updating is not feasible, review your server configurations to avoid socket operations that may trigger the null pointer dereference in applications using CALIPSO.