CVE-2025-22057
16.04.2025, 15:15
In the Linux kernel, the following vulnerability has been resolved:
net: decrease cached dst counters in dst_release
Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in
dst_release()") moved decrementing the dst count from dst_destroy to
dst_release to avoid accessing already freed data in case of netns
dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels
are used, this fix is incomplete as the same issue will be seen for
cached dsts:
Unable to handle kernel paging request at virtual address ffff5aabf6b5c000
Call trace:
percpu_counter_add_batch+0x3c/0x160 (P)
dst_release+0xec/0x108
dst_cache_destroy+0x68/0xd8
dst_destroy+0x13c/0x168
dst_destroy_rcu+0x1c/0xb0
rcu_do_batch+0x18c/0x7d0
rcu_core+0x174/0x378
rcu_core_si+0x18/0x30
Fix this by invalidating the cache, and thus decrementing cached dst
counters, in dst_release too.Enginsight| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 4.6 ≤ 𝑥 < 6.6.87 |
| linux | linux_kernel | 6.7 ≤ 𝑥 < 6.12.23 |
| linux | linux_kernel | 6.13 ≤ 𝑥 < 6.13.11 |
| linux | linux_kernel | 6.14 ≤ 𝑥 < 6.14.2 |
𝑥
= Vulnerable software versions
Debian Releases
References