CVE-2025-37961

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix uninit-value for saddr in do_output_route4

syzbot reports for uninit-value for the saddr argument [1].

commit 4754957f04f5 ("ipvs: do not use random local source address for

tunnels") already implies that the input value of saddr

should be ignored but the code is still reading it which can prevent

to connect the route. Fix it by changing the argument to ret_saddr.

[1]

BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147

do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147

__ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330

ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136

ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063

nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]

nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626

nf_hook include/linux/netfilter.h:269 [inline]

__ip_local_out+0x758/0x7e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References