CVE-2025-38192

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: clear the dst when changing skb protocol<br /> <br /> A not-so-careful NAT46 BPF program can crash the kernel<br /> if it indiscriminately flips ingress packets from v4 to v6:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> ip6_rcv_core (net/ipv6/ip6_input.c:190:20)<br /> ipv6_rcv (net/ipv6/ip6_input.c:306:8)<br /> process_backlog (net/core/dev.c:6186:4)<br /> napi_poll (net/core/dev.c:6906:9)<br /> net_rx_action (net/core/dev.c:7028:13)<br /> do_softirq (kernel/softirq.c:462:3)<br /> netif_rx (net/core/dev.c:5326:3)<br /> dev_loopback_xmit (net/core/dev.c:4015:2)<br /> ip_mc_finish_output (net/ipv4/ip_output.c:363:8)<br /> NF_HOOK (./include/linux/netfilter.h:314:9)<br /> ip_mc_output (net/ipv4/ip_output.c:400:5)<br /> dst_output (./include/net/dst.h:459:9)<br /> ip_local_out (net/ipv4/ip_output.c:130:9)<br /> ip_send_skb (net/ipv4/ip_output.c:1496:8)<br /> udp_send_skb (net/ipv4/udp.c:1040:8)<br /> udp_sendmsg (net/ipv4/udp.c:1328:10)<br /> <br /> The output interface has a 4-&gt;6 program attached at ingress.<br /> We try to loop the multicast skb back to the sending socket.<br /> Ingress BPF runs as part of netif_rx(), pushes a valid v6 hdr<br /> and changes skb-&gt;protocol to v6. We enter ip6_rcv_core which<br /> tries to use skb_dst(). But the dst is still an IPv4 one left<br /> after IPv4 mcast output.<br /> <br /> Clear the dst in all BPF helpers which change the protocol.<br /> Try to preserve metadata dsts, those may carry non-routing<br /> metadata.