CVE-2025-38192 (GCVE-0-2025-38192)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-08-05 12:00
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address: 0000000000000000 ip6_rcv_core (net/ipv6/ip6_input.c:190:20) ipv6_rcv (net/ipv6/ip6_input.c:306:8) process_backlog (net/core/dev.c:6186:4) napi_poll (net/core/dev.c:6906:9) net_rx_action (net/core/dev.c:7028:13) do_softirq (kernel/softirq.c:462:3) netif_rx (net/core/dev.c:5326:3) dev_loopback_xmit (net/core/dev.c:4015:2) ip_mc_finish_output (net/ipv4/ip_output.c:363:8) NF_HOOK (./include/linux/netfilter.h:314:9) ip_mc_output (net/ipv4/ip_output.c:400:5) dst_output (./include/net/dst.h:459:9) ip_local_out (net/ipv4/ip_output.c:130:9) ip_send_skb (net/ipv4/ip_output.c:1496:8) udp_send_skb (net/ipv4/udp.c:1040:8) udp_sendmsg (net/ipv4/udp.c:1328:10) The output interface has a 4->6 program attached at ingress. We try to loop the multicast skb back to the sending socket. Ingress BPF runs as part of netif_rx(), pushes a valid v6 hdr and changes skb->protocol to v6. We enter ip6_rcv_core which tries to use skb_dst(). But the dst is still an IPv4 one left after IPv4 mcast output. Clear the dst in all BPF helpers which change the protocol. Try to preserve metadata dsts, those may carry non-routing metadata.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6578171a7ff0c31dc73258f93da7407510abf085
Version: 6578171a7ff0c31dc73258f93da7407510abf085
Version: 6578171a7ff0c31dc73258f93da7407510abf085
Version: 6578171a7ff0c31dc73258f93da7407510abf085
Version: 6578171a7ff0c31dc73258f93da7407510abf085
Version: 6578171a7ff0c31dc73258f93da7407510abf085
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:41:36.573Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a046f183d21ab5ace5a96ece4cf9873a42f003a7",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            },
            {
              "lessThan": "98b1d8dc9a3170b2614f1e8c93854e75cdd83980",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            },
            {
              "lessThan": "bfa4d86e130a09f67607482e988313430e38f6c4",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            },
            {
              "lessThan": "2a3ad42a57b43145839f2f233fb562247658a6d9",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            },
            {
              "lessThan": "e9994e7b9f7bbb882d13c8191731649249150d21",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            },
            {
              "lessThan": "ba9db6f907ac02215e30128770f85fbd7db2fcf9",
              "status": "affected",
              "version": "6578171a7ff0c31dc73258f93da7407510abf085",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: clear the dst when changing skb protocol\n\nA not-so-careful NAT46 BPF program can crash the kernel\nif it indiscriminately flips ingress packets from v4 to v6:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n    ip6_rcv_core (net/ipv6/ip6_input.c:190:20)\n    ipv6_rcv (net/ipv6/ip6_input.c:306:8)\n    process_backlog (net/core/dev.c:6186:4)\n    napi_poll (net/core/dev.c:6906:9)\n    net_rx_action (net/core/dev.c:7028:13)\n    do_softirq (kernel/softirq.c:462:3)\n    netif_rx (net/core/dev.c:5326:3)\n    dev_loopback_xmit (net/core/dev.c:4015:2)\n    ip_mc_finish_output (net/ipv4/ip_output.c:363:8)\n    NF_HOOK (./include/linux/netfilter.h:314:9)\n    ip_mc_output (net/ipv4/ip_output.c:400:5)\n    dst_output (./include/net/dst.h:459:9)\n    ip_local_out (net/ipv4/ip_output.c:130:9)\n    ip_send_skb (net/ipv4/ip_output.c:1496:8)\n    udp_send_skb (net/ipv4/udp.c:1040:8)\n    udp_sendmsg (net/ipv4/udp.c:1328:10)\n\nThe output interface has a 4-\u003e6 program attached at ingress.\nWe try to loop the multicast skb back to the sending socket.\nIngress BPF runs as part of netif_rx(), pushes a valid v6 hdr\nand changes skb-\u003eprotocol to v6. We enter ip6_rcv_core which\ntries to use skb_dst(). But the dst is still an IPv4 one left\nafter IPv4 mcast output.\n\nClear the dst in all BPF helpers which change the protocol.\nTry to preserve metadata dsts, those may carry non-routing\nmetadata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale dst only survives to the ingress BPF hook on locally generated traffic (loopback_xmit\u0027s skb_dst_force, or ip_mc_output\u0027s dev_loopback_xmit); packets received from the wire have skb_dst == NULL at sch_handle_ingress, so there is no remote trigger. The attacker must be a local user sending packets from a socket.\nAC:L - Triggering is fully deterministic \u2014 a single sendto() to a multicast group with the default IP_MULTICAST_LOOP, or to a local address over lo, reaches the ingress BPF hook with a live IPv4 dst attached. No race, timing window, or unpredictable state is involved.\nPR:L - On a system running a legitimate NAT46/NAT64 tc-BPF program (Android CLAT, Cilium NAT46/64), an ordinary unprivileged user needs nothing beyond an unprivileged UDP socket to generate the looped-back traffic that hits the bug. No capability is required for the triggering action itself.\nUI:N - The attacker generates the triggering packet entirely on their own via a socket send; no victim action, mount, or file open is needed.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory and networking state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - ip6_dst_idev() reads rt6i_idev at dst+72 from a 192-byte rtable slab object, an out-of-bounds read into the adjacent object, and the resulting ifindex is stored in IP6CB(skb)-\u003eiif and copied to userspace as ipi6_ifindex via IPV6_PKTINFO, yielding a kernel-memory disclosure primitive on top of the type confusion.\nI:H - ip6_rcv_finish() skips the IPv6 route lookup and dst_input() dispatches the IPv4 input handler on an IPv6 skb (and vice versa), a cross-family type confusion in which skb_rtable()-\u003ert_iif and -\u003ert_flags are read out of rt6_info\u0027s address/pointer fields and steer socket demultiplexing and delivery decisions.\nA:H - The confirmed result is a NULL/wild pointer dereference inside ip6_rcv_core() executing in softirq context, producing an immediate kernel oops or panic that any unprivileged user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:17.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a046f183d21ab5ace5a96ece4cf9873a42f003a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b1d8dc9a3170b2614f1e8c93854e75cdd83980"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa4d86e130a09f67607482e988313430e38f6c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a3ad42a57b43145839f2f233fb562247658a6d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9994e7b9f7bbb882d13c8191731649249150d21"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba9db6f907ac02215e30128770f85fbd7db2fcf9"
        }
      ],
      "title": "net: clear the dst when changing skb protocol",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38192",
    "datePublished": "2025-07-04T13:37:16.642Z",
    "dateReserved": "2025-04-16T04:51:23.993Z",
    "dateUpdated": "2026-08-05T12:00:17.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.