{"id":"CVE-2025-22103","title":"net: fix NULL pointer dereference in l3mdev_l3_rcv","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\n\nWhen delete l3s ipvlan:\n\n    ip link del link eth0 ipvlan1 type ipvlan mode l3s\n\nThis may cause a null pointer deref…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 1da52878f7fb74ace304f74325bb89e3e5546b55","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < d97d6b1bd2b7f2a188d261d44c4519a13b8c406a","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 52b44d8c653459c658b733d13658afdde45f6836","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 59599bce44af3df7a215ebc81cb166426e1c9204","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < f9dff65140efc289f01bcf39c3ca66a8806b6132","Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 0032c99e83b9ce6d5995d65900aa4b6ffb501cce","Linux 5.1"],"published":"2025-04-16","updated":"2026-09-14","sourceUpdated":"2026-09-14T11:57:55.772Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22103","references":[{"url":"https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55"},{"url":"https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a"},{"url":"https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862"},{"url":"https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836"},{"url":"https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204"},{"url":"https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132"},{"url":"https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce"}],"tags":["cve.org"],"epss":0.00204,"epssPercentile":0.10693,"ingestedAt":"2026-09-14T15:23:07.459Z","slug":"CVE-2025-22103","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\n\nWhen delete l3s ipvlan:\n\n    ip link del link eth0 ipvlan1 type ipvlan mode l3s\n\nThis may cause a null pointer dereference:\n\n    Call trace:\n     ip_rcv_finish+0x48/0xd0\n     ip_rcv+0x5c/0x100\n     __netif_receive_skb_one_core+0x64/0xb0\n     __netif_receive_skb+0x20/0x80\n     process_backlog+0xb4/0x204\n     napi_poll+0xe8/0x294\n     net_rx_action+0xd8/0x22c\n     __do_softirq+0x12c/0x354\n\nThis is because l3mdev_l3_rcv() visit dev->l3mdev_ops after\nipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process\nlike this:\n\n    (CPU1)                     | (CPU2)\n    l3mdev_l3_rcv()            |\n      check dev->priv_flags:   |\n        master = skb->dev;     |\n                               |\n                               | ipvlan_l3s_unregister()\n                               |   set dev->priv_flags\n                               |   dev->l3mdev_ops = NULL;\n                               |\n      visit master->l3mdev_ops |\n\nTo avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.\n\n## Affected\n\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 1da52878f7fb74ace304f74325bb89e3e5546b55`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < d97d6b1bd2b7f2a188d261d44c4519a13b8c406a`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 52b44d8c653459c658b733d13658afdde45f6836`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 59599bce44af3df7a215ebc81cb166426e1c9204`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < f9dff65140efc289f01bcf39c3ca66a8806b6132`\n- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 0032c99e83b9ce6d5995d65900aa4b6ffb501cce`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202671,"id":"CVE-2025-22103","ts":1789402174426,"field":"cvss","old":"5.5","new":null},{"seq":202670,"id":"CVE-2025-22103","ts":1789402174426,"field":"severity","old":"medium","new":"none"}]}