CVE-2025-68813

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix ipv4 null-ptr-deref in route error path

The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure()

without ensuring skb->dev is set, leading to a NULL pointer dereference

in fib_compute_spec_dst() when ipv4_link_failure() attempts to send

ICMP destination unreachable messages.

The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options

in ipv4_link_failure") started calling __ip_options_compile() from

ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst()

which dereferences skb->dev. An attempt was made to fix the NULL skb->dev

dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in

ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev)

dereference by using a fallback device. The fix was incomplete because

fib_compute_spec_dst() later in the call chain still accesses skb->dev

directly, which remains NULL when IPVS calls dst_link_failure().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References