CVE-2025-68353: net: vxlan: prevent NULL deref in vxlan_xmit_one
In the Linux kernel, the following vulnerability has been resolved:
net: vxlan: prevent NULL deref in vxlanxmitone
Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlanxmitone, e.g. if the iface is brought down. This can lead to the following NULL dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:vxlanxmitone+0xbb3/0x1580 Call Trace: vxlanxmit+0x429/0x610 devhardstartxmit+0x55/0xa0 devqueuexmit+0x6d0/0x7f0 ipfinishoutput2+0x24b/0x590 ipoutput+0x63/0x110
Mentioned commits changed the code path in vxlanxmitone and as a side effect the sock4/6 pointer validity checks in vxlan(6)getroute were lost. Fix this by adding back checks.
Since both commits being fixed were released in the same version (v6.7) and are strongly related, bundle the fixes in a single commit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-22.22~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-22.22.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1010.11~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-22.22 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-22.22.1 - Compensating control
Add back the sock4 and sock6 pointer validity checks in vxlan(6)_get_route and vxlan_xmit_one, including the path used when the interface is brought down, to prevent NULL dereferences.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68353?
CVE-2025-68353 is classified as a medium severity vulnerability due to the potential for a NULL dereference in the Linux kernel.
How do I fix CVE-2025-68353?
To fix CVE-2025-68353, you need to update your Linux kernel to version 6.7 or later where this vulnerability has been resolved.
What systems are affected by CVE-2025-68353?
CVE-2025-68353 specifically affects the Linux kernel version 6.7.
What could happen if CVE-2025-68353 is exploited?
Exploiting CVE-2025-68353 could lead to a crash of the affected system due to a NULL dereference in the vxlan_xmit_one function.
Is CVE-2025-68353 related to network functionality?
Yes, CVE-2025-68353 is related to network functionality as it involves the vxlan implementation in the Linux kernel.