Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. This occurs when specific network programs (BPF) incorrectly handle the conversion of network traffic between IPv4 and IPv6 protocols. An exploit would result in a kernel crash (Blue Screen equivalent), leading to a complete service outage for the affected system.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel networking stack (specifically in ip6_rcv_core) due to improper handling of the destination entry (dst) when changing a socket buffer (skb) protocol. When a BPF program (such as a NAT46 implementation) flips ingress packets from IPv4 to IPv6, it may leave a stale IPv4 destination entry on the skb. When the IPv6 stack subsequently attempts to process this packet, it accesses the incompatible destination entry, leading to a kernel panic. The fix involves ensuring BPF helpers that modify skb->protocol also clear the associated dst entry. This is reachable by local users capable of loading or triggering specific BPF network programs.
Affected products
- Linux Linux Kernel 4.8 to 6.6.95, 6.7 to 6.12.35, 6.13 to 6.15.4, 6.16-rc1
Timeline
- 2025-07-04: advisory: NVD Published Date
- 2025-06-27: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/2a3ad42a57b43145839f2f233fb562247658a6d9
- https://git.kernel.org/stable/c/98b1d8dc9a3170b2614f1e8c93854e75cdd83980
- https://git.kernel.org/stable/c/a046f183d21ab5ace5a96ece4cf9873a42f003a7
- https://git.kernel.org/stable/c/ba9db6f907ac02215e30128770f85fbd7db2fcf9
- https://git.kernel.org/stable/c/bfa4d86e130a09f67607482e988313430e38f6c4
- https://git.kernel.org/stable/c/e9994e7b9f7bbb882d13c8191731649249150d21