CVE-2025-22056

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_tunnel: fix geneve_opt type confusion addition

When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the

parsing logic should place every geneve_opt structure one by one

compactly. Hence, when deciding the next geneve_opt position, the

pointer addition should be in units of char *.

However, the current implementation erroneously does type conversion

before the addition, which will lead to heap out-of-bounds write.

[ 6.989857] ==================================================================

[ 6.990293] BUG: KASAN: slab-out-of-bounds in nft_tunnel_obj_init+0x977/0xa70

[ 6.990725] Write of size 124 at addr ffff888005f18974 by task poc/178

[ 6.991162]

[ 6.991259] CPU: 0 PID: 178 Comm: poc-oob-write Not tainted 6.1.132 #1

[ 6.991655] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

[ 6.992281] Call Trace:

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References