{"id":"CVE-2025-22103","state":"PUBLISHED","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\n\nWhen delete l3s ipvlan:\n\n    ip link del link eth0 ipvlan1 type ipvlan mode l3s\n\nThis may cause a null pointer dereference:\n\n    Call trace:\n     ip_rcv_finish+0x48/0xd0\n     ip_rcv+0x5c/0x100\n     __netif_receive_skb_one_core+0x64/0xb0\n     __netif_receive_skb+0x20/0x80\n     process_backlog+0xb4/0x204\n     napi_poll+0xe8/0x294\n     net_rx_action+0xd8/0x22c\n     __do_softirq+0x12c/0x354\n\nThis is because l3mdev_l3_rcv() visit dev->l3mdev_ops after\nipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process\nlike this:\n\n    (CPU1)                     | (CPU2)\n    l3mdev_l3_rcv()            |\n      check dev->priv_flags:   |\n        master = skb->dev;     |\n                               |\n                               | ipvlan_l3s_unregister()\n                               |   set dev->priv_flags\n                               |   dev->l3mdev_ops = NULL;\n                               |\n      visit master->l3mdev_ops |\n\nTo avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.","publishedAt":"2025-04-16T14:12:52.164Z","updatedAt":"2026-09-14T11:57:55.772Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"1da52878f7fb74ace304f74325bb89e3e5546b55","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"d97d6b1bd2b7f2a188d261d44c4519a13b8c406a","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"52b44d8c653459c658b733d13658afdde45f6836","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"59599bce44af3df7a215ebc81cb166426e1c9204","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"f9dff65140efc289f01bcf39c3ca66a8806b6132","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ipvlan/ipvlan_l3s.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.1","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.117","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.2","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ipvlan/ipvlan_l3s.c"]}],"references":["https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55","https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a","https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862","https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836","https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204","https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132","https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/22xxx/CVE-2025-22103.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22103","state":"PUBLISHED","datePublished":"2025-04-16T14:12:52.164Z","dateUpdated":"2026-09-14T11:57:55.772Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.819Z"},"containers":{"cna":{"title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\n\nWhen delete l3s ipvlan:\n\n    ip link del link eth0 ipvlan1 type ipvlan mode l3s\n\nThis may cause a null pointer dereference:\n\n    Call trace:\n     ip_rcv_finish+0x48/0xd0\n     ip_rcv+0x5c/0x100\n     __netif_receive_skb_one_core+0x64/0xb0\n     __netif_receive_skb+0x20/0x80\n     process_backlog+0xb4/0x204\n     napi_poll+0xe8/0x294\n     net_rx_action+0xd8/0x22c\n     __do_softirq+0x12c/0x354\n\nThis is because l3mdev_l3_rcv() visit dev->l3mdev_ops after\nipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process\nlike this:\n\n    (CPU1)                     | (CPU2)\n    l3mdev_l3_rcv()            |\n      check dev->priv_flags:   |\n        master = skb->dev;     |\n                               |\n                               | ipvlan_l3s_unregister()\n                               |   set dev->priv_flags\n                               |   dev->l3mdev_ops = NULL;\n                               |\n      visit master->l3mdev_ops |\n\nTo avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"1da52878f7fb74ace304f74325bb89e3e5546b55","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"d97d6b1bd2b7f2a188d261d44c4519a13b8c406a","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"52b44d8c653459c658b733d13658afdde45f6836","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"59599bce44af3df7a215ebc81cb166426e1c9204","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"f9dff65140efc289f01bcf39c3ca66a8806b6132","versionType":"git"},{"version":"c675e06a98a474f7ad0af32ce467613da818da52","status":"affected","lessThan":"0032c99e83b9ce6d5995d65900aa4b6ffb501cce","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ipvlan/ipvlan_l3s.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.1","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.117","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.2","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ipvlan/ipvlan_l3s.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55"},{"url":"https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a"},{"url":"https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862"},{"url":"https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836"},{"url":"https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204"},{"url":"https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132"},{"url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-09-14T11:57:55.772Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.6.117"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.14.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}