{
  "threat_severity" : "Moderate",
  "public_date" : "2025-04-16T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: net: fix NULL pointer dereference in l3mdev_l3_rcv",
    "id" : "2360269",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2360269"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\nWhen delete l3s ipvlan:\nip link del link eth0 ipvlan1 type ipvlan mode l3s\nThis may cause a null pointer dereference:\nCall trace:\nip_rcv_finish+0x48/0xd0\nip_rcv+0x5c/0x100\n__netif_receive_skb_one_core+0x64/0xb0\n__netif_receive_skb+0x20/0x80\nprocess_backlog+0xb4/0x204\nnapi_poll+0xe8/0x294\nnet_rx_action+0xd8/0x22c\n__do_softirq+0x12c/0x354\nThis is because l3mdev_l3_rcv() visit dev->l3mdev_ops after\nipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process\nlike this:\n(CPU1)                     | (CPU2)\nl3mdev_l3_rcv()            |\ncheck dev->priv_flags:   |\nmaster = skb->dev;     |\n|\n| ipvlan_l3s_unregister()\n|   set dev->priv_flags\n|   dev->l3mdev_ops = NULL;\n|\nvisit master->l3mdev_ops |\nTo avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.", "CVE-2025-22103 is a bug in the Linux operating system that affects how it handles certain virtual network interfaces called IPvlan interfaces, specifically when they're running in a special mode called L3S (Layer 3 Simplified). These virtual interfaces are often used in advanced networking setups, like containers or virtual machines.\nThe problem happens when one of these virtual interfaces is being deleted. If the system is still trying to use it at the exact moment it's being removed, Linux might try to access something that's already gone. This leads to a situation where the system hits an error and crashes completely — resulting in a kernel panic (essentially a Linux version of a system-wide crash).\nThe root of the problem is that Linux doesn't always wait for things to finish properly before cleaning up, which opens a short window where one part of the system thinks the interface still exists, while another part has already removed it.\nThe issue has been fixed in newer versions of the Linux kernel (starting from version 6.15-rc1), so applying the latest updates will prevent this crash from occurring." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-22103\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22103\nhttps://lore.kernel.org/linux-cve-announce/2025041621-CVE-2025-22103-b3a2@gregkh/T" ],
  "name" : "CVE-2025-22103",
  "csaw" : false
}