CVE-2025-22103net: fix NULL pointer dereference in l3mdev_l3_rcv
- 5.5MediumCVSS base score
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.
Timeline
ID reserved
By Linux
- 4 months later
· 4 months later
Published
- 17 months later
· 17 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < 1da52878f7fb74ace304f74325bb89e3e5546b55
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < d97d6b1bd2b7f2a188d261d44c4519a13b8c406a
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < 8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < 52b44d8c653459c658b733d13658afdde45f6836
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < 59599bce44af3df7a215ebc81cb166426e1c9204
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < f9dff65140efc289f01bcf39c3ca66a8806b6132
- affected c675e06a98a474f7ad0af32ce467613da818da52 – < 0032c99e83b9ce6d5995d65900aa4b6ffb501cce
- affected 5.1
- unaffected < 5.1
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.117 – ≤ 6.6.*
- unaffected 6.12.46 – ≤ 6.12.*
- unaffected 6.14.2 – ≤ 6.14.*
- unaffected 6.15 – ≤ *
References
References7
- https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55 (opens in a new tab)
- https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a (opens in a new tab)
- https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862 (opens in a new tab)
- https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836 (opens in a new tab)
- https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 (opens in a new tab)
- https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 (opens in a new tab)
- https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-11207 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-22103)Record last updated .