ipvs: fix ipv4 null-ptr-deref in route error path
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure(). The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev fro
CVE-2025-68813
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-68813
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "dd72a93c80408f06327dd2d956eb1a656d0b5903",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "312d7cd88882fc6cadcc08b02287497aaaf94bcd",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "cdeff10851c37a002d87a035818ebd60fdb74447",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "4729ff0581fbb7ad098b6153b76b6f5aac94618a",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "25ab24df31f7af843c96a38e0781b9165216e1a8",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "689a627d14788ad772e0fa24c2e57a23dbc7ce90",
"versionType": "git"
},
{
"status": "affected",
"version": "ed0de45a1008991fdaa27a0152befcb74d126a8b",
"lessThan": "ad891bb3d079a46a821bf2b8867854645191bab0",
"versionType": "git"
},
{
"status": "affected",
"version": "6c2fa855d8178699706b1192db2f1f8102b0ba1e",
"versionType": "git"
},
{
"status": "affected",
"version": "fbf569d2beee2a4a7a0bc8b619c26101d1211a88",
"versionType": "git"
},
{
"status": "affected",
"version": "ff71f99d5fb2daf54340e8b290d0bc4e6b4c1d38",
"versionType": "git"
},
{
"status": "affected",
"version": "3d988fcddbe7b8673a231958bd2fba61b5a7ced9",
"versionType": "git"
},
{
"status": "affected",
"version": "8a430e56a6485267a1b2d3747209d26c54d1a34b",
"versionType": "git"
},
{
"status": "affected",
"version": "6bd1ee0a993fc9574ae43c1994c54a60cb23a380",
"versionType": "git"
},
{
"status": "affected",
"version": "3.18.139",
"lessThan": "3.19",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.179",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.171",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.114",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.37",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.0.10",
"lessThan": "5.1",
"versionType": "semver"
}
],
"programFiles": [
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.3",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-68813
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #39129 · Revision 1
- Added to Heist Feed
- Publisher date