CVE-2025-22103

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer dereference in l3mdev_l3_rcv

When delete l3s ipvlan:

ip link del link eth0 ipvlan1 type ipvlan mode l3s

This may cause a null pointer dereference:

Call trace:

ip_rcv_finish+0x48/0xd0

ip_rcv+0x5c/0x100

__netif_receive_skb_one_core+0x64/0xb0

__netif_receive_skb+0x20/0x80

process_backlog+0xb4/0x204

napi_poll+0xe8/0x294

net_rx_action+0xd8/0x22c

__do_softirq+0x12c/0x354

This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after

ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process

like this:

(CPU1) | (CPU2)

l3mdev_l3_rcv() |

check dev->priv_flags: |

master = skb->dev; |

|

| ipvlan_l3s_unregister()

| set dev->priv_flags

| dev->l3mdev_ops = NULL;

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References