Kernel Vulnerability in Linux Package: Memory Access Issue in Cached dsts
Summary
CVE-2025-22057: In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. This vulnerability affects the kernel's networking subsystem, specifically when using destination (dst) caching in conjunction with Open vSwitch (OvS) and tunnels, potentially leading to memory access violations.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified related to the handling of cached destination entries (dsts). The issue arises when the decrementing of the dst count is improperly managed during the release process, leading to the potential access of already freed data. This can result in kernel paging requests that may crash the system or lead to undefined behavior. The vulnerability is particularly relevant when CONFIG_DST_CACHE is enabled, as it can expose systems to risks when using Open vSwitch with tunnels.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the CONFIG_DST_CACHE option in the kernel configuration if feasible. This can help mitigate the risk until a proper patch is applied. However, this may affect the performance of networking operations that rely on dst caching.
Conclusion
The CVE-2025-22057 vulnerability in the Linux kernel highlights a critical issue related to memory access in cached destination entries. Users are advised to update their systems to the latest patched version of the Linux package to mitigate risks. Temporary workarounds are available, but the best course of action is to apply the official fix as soon as possible.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22057 is a vulnerability in the Linux kernel that affects the handling of cached destination entries, potentially leading to memory access violations.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential system crashes, undefined behavior, and exposure to security threats due to improper memory access.
Yes, a patch is available in the latest versions of the Linux package. Users should update their systems to the latest version to mitigate the vulnerability.
If immediate updates are not possible, consider disabling CONFIG_DST_CACHE as a temporary workaround to reduce the risk until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
