{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38192","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:23.993Z","datePublished":"2025-07-04T13:37:16.642Z","dateUpdated":"2026-08-05T12:00:17.069Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:00:17.069Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: clear the dst when changing skb protocol\n\nA not-so-careful NAT46 BPF program can crash the kernel\nif it indiscriminately flips ingress packets from v4 to v6:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n    ip6_rcv_core (net/ipv6/ip6_input.c:190:20)\n    ipv6_rcv (net/ipv6/ip6_input.c:306:8)\n    process_backlog (net/core/dev.c:6186:4)\n    napi_poll (net/core/dev.c:6906:9)\n    net_rx_action (net/core/dev.c:7028:13)\n    do_softirq (kernel/softirq.c:462:3)\n    netif_rx (net/core/dev.c:5326:3)\n    dev_loopback_xmit (net/core/dev.c:4015:2)\n    ip_mc_finish_output (net/ipv4/ip_output.c:363:8)\n    NF_HOOK (./include/linux/netfilter.h:314:9)\n    ip_mc_output (net/ipv4/ip_output.c:400:5)\n    dst_output (./include/net/dst.h:459:9)\n    ip_local_out (net/ipv4/ip_output.c:130:9)\n    ip_send_skb (net/ipv4/ip_output.c:1496:8)\n    udp_send_skb (net/ipv4/udp.c:1040:8)\n    udp_sendmsg (net/ipv4/udp.c:1328:10)\n\nThe output interface has a 4->6 program attached at ingress.\nWe try to loop the multicast skb back to the sending socket.\nIngress BPF runs as part of netif_rx(), pushes a valid v6 hdr\nand changes skb->protocol to v6. We enter ip6_rcv_core which\ntries to use skb_dst(). But the dst is still an IPv4 one left\nafter IPv4 mcast output.\n\nClear the dst in all BPF helpers which change the protocol.\nTry to preserve metadata dsts, those may carry non-routing\nmetadata."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The stale dst only survives to the ingress BPF hook on locally generated traffic (loopback_xmit's skb_dst_force, or ip_mc_output's dev_loopback_xmit); packets received from the wire have skb_dst == NULL at sch_handle_ingress, so there is no remote trigger. The attacker must be a local user sending packets from a socket.\nAC:L - Triggering is fully deterministic — a single sendto() to a multicast group with the default IP_MULTICAST_LOOP, or to a local address over lo, reaches the ingress BPF hook with a live IPv4 dst attached. No race, timing window, or unpredictable state is involved.\nPR:L - On a system running a legitimate NAT46/NAT64 tc-BPF program (Android CLAT, Cilium NAT46/64), an ordinary unprivileged user needs nothing beyond an unprivileged UDP socket to generate the looped-back traffic that hits the bug. No capability is required for the triggering action itself.\nUI:N - The attacker generates the triggering packet entirely on their own via a socket send; no victim action, mount, or file open is needed.\nS:U - The corruption and its consequences are confined to the kernel's own memory and networking state within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - ip6_dst_idev() reads rt6i_idev at dst+72 from a 192-byte rtable slab object, an out-of-bounds read into the adjacent object, and the resulting ifindex is stored in IP6CB(skb)->iif and copied to userspace as ipi6_ifindex via IPV6_PKTINFO, yielding a kernel-memory disclosure primitive on top of the type confusion.\nI:H - ip6_rcv_finish() skips the IPv6 route lookup and dst_input() dispatches the IPv4 input handler on an IPv6 skb (and vice versa), a cross-family type confusion in which skb_rtable()->rt_iif and ->rt_flags are read out of rt6_info's address/pointer fields and steer socket demultiplexing and delivery decisions.\nA:H - The confirmed result is a NULL/wild pointer dereference inside ip6_rcv_core() executing in softirq context, producing an immediate kernel oops or panic that any unprivileged user can trigger repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"],"versions":[{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"a046f183d21ab5ace5a96ece4cf9873a42f003a7","status":"affected","versionType":"git"},{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"98b1d8dc9a3170b2614f1e8c93854e75cdd83980","status":"affected","versionType":"git"},{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"bfa4d86e130a09f67607482e988313430e38f6c4","status":"affected","versionType":"git"},{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"2a3ad42a57b43145839f2f233fb562247658a6d9","status":"affected","versionType":"git"},{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"e9994e7b9f7bbb882d13c8191731649249150d21","status":"affected","versionType":"git"},{"version":"6578171a7ff0c31dc73258f93da7407510abf085","lessThan":"ba9db6f907ac02215e30128770f85fbd7db2fcf9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"],"versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.167","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.95","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.35","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.4","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.6.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.12.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.15.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a046f183d21ab5ace5a96ece4cf9873a42f003a7"},{"url":"https://git.kernel.org/stable/c/98b1d8dc9a3170b2614f1e8c93854e75cdd83980"},{"url":"https://git.kernel.org/stable/c/bfa4d86e130a09f67607482e988313430e38f6c4"},{"url":"https://git.kernel.org/stable/c/2a3ad42a57b43145839f2f233fb562247658a6d9"},{"url":"https://git.kernel.org/stable/c/e9994e7b9f7bbb882d13c8191731649249150d21"},{"url":"https://git.kernel.org/stable/c/ba9db6f907ac02215e30128770f85fbd7db2fcf9"}],"title":"net: clear the dst when changing skb protocol","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-07-14T12:41:36.573Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}}