CVE-2025-38192: net: clear the dst when changing skb protocol
In the Linux kernel, the following vulnerability has been resolved:
net: clear the dst when changing skb protocol
A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ip6rcvcore (net/ipv6/ip6input.c:190:20) ipv6rcv (net/ipv6/ip6input.c:306:8) processbacklog (net/core/dev.c:6186:4) napipoll (net/core/dev.c:6906:9) netrxaction (net/core/dev.c:7028:13) dosoftirq (kernel/softirq.c:462:3) netifrx (net/core/dev.c:5326:3) devloopbackxmit (net/core/dev.c:4015:2) ipmcfinishoutput (net/ipv4/ipoutput.c:363:8) NFHOOK (./include/linux/netfilter.h:314:9) ipmcoutput (net/ipv4/ipoutput.c:400:5) dstoutput (./include/net/dst.h:459:9) iplocalout (net/ipv4/ipoutput.c:130:9) ipsendskb (net/ipv4/ipoutput.c:1496:8) udpsendskb (net/ipv4/udp.c:1040:8) udpsendmsg (net/ipv4/udp.c:1328:10)
The output interface has a 4->6 program attached at ingress. We try to loop the multicast skb back to the sending socket. Ingress BPF runs as part of netifrx(), pushes a valid v6 hdr and changes skb->protocol to v6. We enter ip6rcvcore which tries to use skbdst(). But the dst is still an IPv4 one left after IPv4 mcast output.
Clear the dst in all BPF helpers which change the protocol. Try to preserve metadata dsts, those may carry non-routing metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.96.1-1 - Configuration
When implementing/fixing NAT46 BPF logic, ensure any BPF helper that changes the packet protocol (e.g., flips skb->protocol from IPv4 to IPv6) clears the destination metadata (dst) in all BPF helpers so kernel code will not later dereference an invalid skb_dst() (i.e., clear dst before protocol change).
Linux kernel eBPF/BPF helper handling for NAT46 / protocol switching Clear dst in BPF helpers which change the protocol = dst = NULL / cleared dst metadata when flipping skb->protocol between IPv4 and IPv6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38192?
CVE-2025-38192 has a high severity rating due to its potential to crash the Linux kernel.
How do I fix CVE-2025-38192?
To fix CVE-2025-38192, you should update to the latest stable version of the Linux kernel that addresses this vulnerability.
What type of vulnerability is CVE-2025-38192?
CVE-2025-38192 is a kernel NULL pointer dereference vulnerability affecting the Linux kernel.
Which systems are affected by CVE-2025-38192?
CVE-2025-38192 affects systems running vulnerable versions of the Linux kernel.
Can CVE-2025-38192 be exploited remotely?
Yes, CVE-2025-38192 can potentially be exploited remotely if a carefully crafted NAT46 BPF program is used.