Critical NULL Pointer Dereference in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2025-22103: In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null poin... Affects linux versions < 6.12.48-1. Fixed in 6.12.48-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources, hardware interactions, and process scheduling. This package is crucial for system stability and performance, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that leads to a NULL pointer dereference in the l3mdev_l3_rcv function. This issue arises when deleting an l3s ipvlan interface, specifically through the command 'ip link del link eth0 ipvlan1 type ipvlan mode l3s'. The vulnerability occurs because the l3mdev_l3_rcv function accesses dev->l3mdev_ops after the ipvlan_l3s_unregister function has set it to NULL, potentially leading to system crashes or undefined behavior. The call trace indicates the sequence of function calls leading to this dereference, highlighting the risk of instability in network operations.
How To Fix
Minimum fixed version
6.12.48-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the command to delete l3s ipvlan interfaces until the package is updated to the patched version. This can prevent the occurrence of the NULL pointer dereference.
Conclusion
The identified vulnerability in the Linux kernel's handling of l3mdev_l3_rcv poses significant risks to system stability and network operations. It is crucial for users to update their linux package to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory that has not been allocated or is set to NULL, leading to crashes or unpredictable behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check if your application is affected.
Exploiting this vulnerability could lead to system crashes, loss of network functionality, and potential denial of service, impacting overall system stability.
Yes, avoid deleting l3s ipvlan interfaces until the patch is applied to prevent triggering the NULL pointer dereference.
Detailed information can be found in the Debian CVE database or by visiting Vulert's website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
