Kernel Vulnerability in Linux Package: Potential Crash Due to Improper Protocol Handling
Summary
DEBIAN-CVE-2025-38192: In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services for all other software applications. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, such as the one identified in this report, which affects the handling of network packets and could lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that occurs when a NAT46 BPF program improperly handles the conversion of ingress packets from IPv4 to IPv6. This can lead to a NULL pointer dereference in the kernel, resulting in a crash. The issue arises when the destination (dst) is not cleared during the protocol change, causing the kernel to attempt to access an invalid memory address. The vulnerability can be exploited by malicious actors to disrupt system operations, leading to potential denial of service.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using NAT46 BPF programs that indiscriminately flip ingress packets from IPv4 to IPv6 until the patch is applied. This may help prevent the kernel crash while a permanent fix is being implemented.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk by potentially causing system crashes due to improper handling of network packets. Users are strongly advised to update their systems to the patched version to mitigate this risk. Temporary workarounds are available, but the best course of action is to apply the fix as soon as possible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel crash, resulting in a denial of service for the affected system.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability affects Linux versions prior to 6.12.35-1 in both Debian 13 and Debian 14.
Yes, updating to version 6.12.35-1 or later will resolve the vulnerability.
If immediate updating is not possible, refrain from using the affected NAT46 BPF programs as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
