CVE-2025-38589

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

neighbour: Fix null-ptr-deref in neigh_flush_dev().

kernel test robot reported null-ptr-deref in neigh_flush_dev(). [0]

The cited commit introduced per-netdev neighbour list and converted

neigh_flush_dev() to use it instead of the global hash table.

One thing we missed is that neigh_table_clear() calls neigh_ifdown()

with NULL dev.

Let's restore the hash table iteration.

Note that IPv6 module is no longer unloadable, so neigh_table_clear()

is called only when IPv6 fails to initialise, which is unlikely to

happen.

[0]:

IPv6: Attempt to unregister permanent protocol 136

IPv6: Attempt to unregister permanent protocol 17

Oops: general protection fault, probably for non-canonical address 0xdffffc00000001a0: 0000 [#1] SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000d00-0x0000000000000d07]

CPU: 1 UID: 0 PID: 1 Comm: systemd Tainted: G T 6.12.0-rc6-01246-gf7f52738637f #1

Tainted: [T]=RANDSTRUCT

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References