Skip to content
Heist/ feed
Back to feed
HighFix available

calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in ran

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.35, 6.15.4, 6.6.95
CVEs
CVE-2025-38181
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 03:10 UTC · Revision 1

Source evidence

calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

core-osv · Original source

Published 4 Jul 2025, 13:37 UTC

In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in ran

osv:CVE-2025-38181

Kernel

Fixed versions: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4

Complete source record
{
  "id": "f19cb9488c38dbe9e0930342c2a306c06f1d700120f3e4db434626000cd711b5",
  "url": "https://osv.dev/vulnerability/CVE-2025-38181",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 (\"tcp: avoid two atomic ops for syncookies\"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 (\"tcp/dccp: do not touch listener sk_refcnt under synflood\"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in ran",
    "evidence": "osv:CVE-2025-38181",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.4.295",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.239",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.186",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.142",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.95",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.35",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.15.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-38181",
      "aliases": [
        "CVE-2025-38181"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e1adea927080821ebfa7505bff752a4015955660"
                },
                {
                  "fixed": "956f1499412ed0953f6a116df7fdb855e9f1fc66"
                },
                {
                  "fixed": "f4ae0f61dd9a63329ecb49b1e6356139d43240b8"
                },
                {
                  "fixed": "dc724bd34d56f5589f7587a091a8cda2386826c4"
                },
                {
                  "fixed": "058dd4a370f23a5553a9449f2db53d5bfa88d45e"
                },
                {
                  "fixed": "bde8833eb075ba8e8674de88e32de6b669966451"
                },
                {
                  "fixed": "988edde4d52d5c02ea4dd95d7619372a5e2fb7b7"
                },
                {
                  "fixed": "d092c7fd8e220b23d6c47e03d7d0cc79e731f379"
                },
                {
                  "fixed": "10876da918fa1aec0227fb4c67647513447f53a9"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38181.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.8.0"
                },
                {
                  "fixed": "5.4.295"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.239"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.186"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.142"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.95"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.35"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.15.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38181.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:46.729602099Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/058dd4a370f23a5553a9449f2db53d5bfa88d45e",
        "https://git.kernel.org/stable/c/10876da918fa1aec0227fb4c67647513447f53a9",
        "https://git.kernel.org/stable/c/956f1499412ed0953f6a116df7fdb855e9f1fc66",
        "https://git.kernel.org/stable/c/988edde4d52d5c02ea4dd95d7619372a5e2fb7b7",
        "https://git.kernel.org/stable/c/bde8833eb075ba8e8674de88e32de6b669966451",
        "https://git.kernel.org/stable/c/d092c7fd8e220b23d6c47e03d7d0cc79e731f379",
        "https://git.kernel.org/stable/c/dc724bd34d56f5589f7587a091a8cda2386826c4",
        "https://git.kernel.org/stable/c/f4ae0f61dd9a63329ecb49b1e6356139d43240b8",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38181.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-38181",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38181.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-38181",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514475,
  "published_at": "2025-07-04T13:37:08.985+00:00"
}