CVE-2025-22103

Low

No strong exploitation signal.

CVSS base

5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — probability of exploitation (30 days)

0.2%

10.7th percentile

CISA KEV

Not listed

Weakness / dates

CWE-476

Published 2025-04-16 · modified 2026-09-14

CVSS breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector	L	Local
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	N	None
Integrity	N	None
Availability	H	High

Timeline

2025-04-16 — Published (NVD)
2026-09-14 — Last modified (NVD)

Description

In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.

Affected

linux

References

Official: NVD · CVE.org