ipvs: fix uninit-value for saddr in do_output_route4
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr. [1] BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727 ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620 __sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg n
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.139, 6.12.29, 6.14.7, 6.6.91
- CVEs
- CVE-2025-37961
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 00:52 UTC · Revision 1
Source evidence
ipvs: fix uninit-value for saddr in do_output_route4
core-osv · Original sourcePublished 20 May 2025, 16:01 UTC
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr. [1] BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727 ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620 __sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg n
osv:CVE-2025-37961
Kernel
Fixed versions: 6.1.139, 6.6.91, 6.12.29, 6.14.7
Complete source record
{
"id": "d04e3caa1e91554d7c290d83f593349d4fa52de570ee5529def3337a55d5a621",
"url": "https://osv.dev/vulnerability/CVE-2025-37961",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ipvs: fix uninit-value for saddr in do_output_route4",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 (\"ipvs: do not use random local source address for tunnels\") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr. [1] BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727 ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620 __sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg n",
"evidence": "osv:CVE-2025-37961",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.139",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.91",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.29",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2025-37961",
"aliases": [
"CVE-2025-37961"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4754957f04f5f368792a0eb7dab0ae89fb93dcfd"
},
{
"fixed": "7d0032112a0380d0b8d7c9005f621928a9b9fc76"
},
{
"fixed": "adbc8cc1162951cb152ed7f147d5fbd35ce3e62f"
},
{
"fixed": "0160ac84fb03a0bd8dce8a42cb25bfaeedd110f4"
},
{
"fixed": "a3a1b784791a3cbfc6e05c4d8a3c321ac5136e25"
},
{
"fixed": "e34090d7214e0516eb8722aee295cb2507317c07"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.10.91"
},
{
"fixed": "3.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.12.50"
},
{
"fixed": "3.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.14.55"
},
{
"fixed": "3.15"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.18.23"
},
{
"fixed": "3.19"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4.1.11"
},
{
"fixed": "4.2"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "212c45ac20229c1752dd56fa38e9a8d57127974b"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2f0c79dd1e9d55a279b0a8e363717b7a896fe7b4"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "cc2b6a186da7580d4557e7175c5ab4b18d9a57f0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e89e653311ac2c9f37ceb778212ae4dbe1104091"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f1d62fb20245bc89d6ba93d829763450250a592b"
}
]
}
],
"versions": [
"v3.10.108",
"v3.10.107",
"v3.10.106",
"v3.10.105",
"v3.10.104",
"v3.10.103",
"v3.10.102",
"v3.10.101",
"v3.10.100",
"v3.10.99",
"v3.10.98",
"v3.10.97",
"v3.10.96",
"v3.10.95",
"v3.10.94",
"v3.10.93",
"v3.10.92",
"v3.10.91",
"v3.12.74",
"v3.12.73",
"v3.12.72",
"v3.12.71",
"v3.12.70",
"v3.12.69",
"v3.12.68",
"v3.12.67",
"v3.12.66",
"v3.12.65",
"v3.12.64",
"v3.12.63",
"v3.12.62",
"v3.12.61",
"v3.12.60",
"v3.12.59",
"v3.12.58",
"v3.12.57",
"v3.12.56",
"v3.12.55",
"v3.12.54",
"v3.12.53",
"v3.12.52",
"v3.12.51",
"v3.12.50",
"v3.14.79",
"v3.14.78",
"v3.14.77",
"v3.14.76",
"v3.14.75",
"v3.14.74",
"v3.14.73",
"v3.14.72",
"v3.14.71",
"v3.14.70",
"v3.14.69",
"v3.14.68",
"v3.14.67",
"v3.14.66",
"v3.14.65",
"v3.14.64",
"v3.14.63",
"v3.14.62",
"v3.14.61",
"v3.14.60",
"v3.14.59",
"v3.14.58",
"v3.14.57",
"v3.14.56",
"v3.14.55",
"v3.18.140",
"v3.18.139",
"v3.18.138",
"v3.18.137",
"v3.18.136",
"v3.18.135",
"v3.18.134",
"v3.18.133",
"v3.18.132",
"v3.18.131",
"v3.18.130",
"v3.18.129",
"v3.18.128",
"v3.18.127",
"v3.18.126",
"v3.18.125",
"v3.18.124",
"v3.18.123",
"v3.18.122",
"v3.18.121",
"v3.18.120",
"v3.18.119",
"v3.18.118",
"v3.18.117",
"v3.18.116",
"v3.18.115",
"v3.18.114",
"v3.18.113",
"v3.18.112",
"v3.18.111",
"v3.18.110",
"v3.18.109",
"v3.18.108",
"v3.18.107",
"v3.18.106",
"v3.18.105",
"v3.18.104",
"v3.18.103",
"v3.18.102",
"v3.18.101",
"v3.18.100",
"v3.18.99",
"v3.18.98",
"v3.18.97",
"v3.18.96",
"v3.18.95",
"v3.18.94",
"v3.18.93",
"v3.18.92",
"v3.18.91",
"v3.18.90",
"v3.18.89",
"v3.18.88",
"v3.18.87",
"v3.18.86",
"v3.18.85",
"v3.18.84",
"v3.18.83",
"v3.18.82",
"v3.18.81",
"v3.18.80",
"v3.18.79",
"v3.18.78",
"v3.18.77",
"v3.18.76",
"v3.18.75",
"v3.18.74",
"v3.18.73",
"v3.18.72",
"v3.18.71",
"v3.18.70",
"v3.18.69",
"v3.18.68",
"v3.18.67",
"v3.18.66",
"v3.18.65",
"v3.18.64",
"v3.18.63",
"v3.18.62",
"v3.18.61",
"v3.18.60",
"v3.18.59",
"v3.18.58",
"v3.18.57",
"v3.18.56",
"v3.18.55",
"v3.18.54",
"v3.18.53",
"v3.18.52",
"v3.18.51",
"v3.18.50",
"v3.18.49",
"v3.18.48",
"v3.18.47",
"v3.18.46",
"v3.18.45",
"v3.18.44",
"v3.18.43",
"v3.18.42",
"v3.18.41",
"v3.18.40",
"v3.18.39",
"v3.18.38",
"v3.18.37",
"v3.18.36",
"v3.18.35",
"v3.18.34",
"v3.18.33",
"v3.18.32",
"v3.18.31",
"v3.18.30",
"v3.18.29",
"v3.18.28",
"v3.18.27",
"v3.18.26",
"v3.18.25",
"v3.18.24",
"v3.18.23",
"v4.1.52",
"v4.1.51",
"v4.1.50",
"v4.1.49",
"v4.1.48",
"v4.1.47",
"v4.1.46",
"v4.1.45",
"v4.1.44",
"v4.1.43",
"v4.1.42",
"v4.1.41",
"v4.1.40",
"v4.1.39",
"v4.1.38",
"v4.1.37",
"v4.1.36",
"v4.1.35",
"v4.1.34",
"v4.1.33",
"v4.1.32",
"v4.1.31",
"v4.1.30",
"v4.1.29",
"v4.1.28",
"v4.1.27",
"v4.1.26",
"v4.1.25",
"v4.1.24",
"v4.1.23",
"v4.1.22",
"v4.1.21",
"v4.1.20",
"v4.1.19",
"v4.1.18",
"v4.1.17",
"v4.1.16",
"v4.1.15",
"v4.1.14",
"v4.1.13",
"v4.1.12",
"v4.1.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37961.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "6.1.139"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.91"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.29"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.14.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37961.json"
}
}
],
"modified": "2026-10-28T02:30:24.937447468Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0160ac84fb03a0bd8dce8a42cb25bfaeedd110f4",
"https://git.kernel.org/stable/c/7d0032112a0380d0b8d7c9005f621928a9b9fc76",
"https://git.kernel.org/stable/c/a3a1b784791a3cbfc6e05c4d8a3c321ac5136e25",
"https://git.kernel.org/stable/c/adbc8cc1162951cb152ed7f147d5fbd35ce3e62f",
"https://git.kernel.org/stable/c/e34090d7214e0516eb8722aee295cb2507317c07",
"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37961.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-37961",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37961.json"
}
},
"related_cves": [
{
"value": "CVE-2025-37961",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491311,
"published_at": "2025-05-20T16:01:53.94+00:00"
}