---
id: CVE-2025-22103
title: 'net: fix NULL pointer dereference in l3mdev_l3_rcv'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: fix NULL pointer dereference in l3mdev_l3_rcv

  When delete l3s ipvlan:

      ip link del link eth0 ipvlan1 type ipvlan mode l3s

  This may cause a null pointer deref…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    1da52878f7fb74ace304f74325bb89e3e5546b55
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    d97d6b1bd2b7f2a188d261d44c4519a13b8c406a
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    52b44d8c653459c658b733d13658afdde45f6836
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    59599bce44af3df7a215ebc81cb166426e1c9204
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    f9dff65140efc289f01bcf39c3ca66a8806b6132
  - >-
    Linux >= c675e06a98a474f7ad0af32ce467613da818da52 <
    0032c99e83b9ce6d5995d65900aa4b6ffb501cce
  - Linux 5.1
published: '2025-04-16'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T11:57:55.772Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22103'
references:
  - url: 'https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55'
  - url: 'https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a'
  - url: 'https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862'
  - url: 'https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836'
  - url: 'https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204'
  - url: 'https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132'
  - url: 'https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce'
tags:
  - cve.org
epss: 0.00204
epssPercentile: 0.10699
ingestedAt: '2026-09-14T15:23:07.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer dereference in l3mdev_l3_rcv

When delete l3s ipvlan:

    ip link del link eth0 ipvlan1 type ipvlan mode l3s

This may cause a null pointer dereference:

    Call trace:
     ip_rcv_finish+0x48/0xd0
     ip_rcv+0x5c/0x100
     __netif_receive_skb_one_core+0x64/0xb0
     __netif_receive_skb+0x20/0x80
     process_backlog+0xb4/0x204
     napi_poll+0xe8/0x294
     net_rx_action+0xd8/0x22c
     __do_softirq+0x12c/0x354

This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after
ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process
like this:

    (CPU1)                     | (CPU2)
    l3mdev_l3_rcv()            |
      check dev->priv_flags:   |
        master = skb->dev;     |
                               |
                               | ipvlan_l3s_unregister()
                               |   set dev->priv_flags
                               |   dev->l3mdev_ops = NULL;
                               |
      visit master->l3mdev_ops |

To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.

## Affected

- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 1da52878f7fb74ace304f74325bb89e3e5546b55`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < d97d6b1bd2b7f2a188d261d44c4519a13b8c406a`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 52b44d8c653459c658b733d13658afdde45f6836`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 59599bce44af3df7a215ebc81cb166426e1c9204`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < f9dff65140efc289f01bcf39c3ca66a8806b6132`
- `Linux >= c675e06a98a474f7ad0af32ce467613da818da52 < 0032c99e83b9ce6d5995d65900aa4b6ffb501cce`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.