CVE-2025-21652

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: Fix use-after-free in ipvlan_get_iflink().

syzbot presented an use-after-free report [0] regarding ipvlan and

linkwatch.

ipvlan does not hold a refcnt of the lower device unlike vlan and

macvlan.

If the linkwatch work is triggered for the ipvlan dev, the lower dev

might have already been freed, resulting in UAF of ipvlan->phy_dev in

ipvlan_get_iflink().

We can delay the lower dev unregistration like vlan and macvlan by

holding the lower dev's refcnt in dev->netdev_ops->ndo_init() and

releasing it in dev->priv_destructor().

Jakub pointed out calling .ndo_XXX after unregister_netdevice() has

returned is error prone and suggested [1] addressing this UAF in the

core by taking commit 750e51603395 ("net: avoid potential UAF in

default_operstate()") further.

Let's assume unregistering devices DOWN and use RCU protection in

default_operstate() not to race with the device unregistration.

[0]:

BUG: KASAN: slab-us

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References