CVE-2025-38184 (GCVE-0-2025-38184)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00
VLAI
Title
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 the ub was in fact a struct dev. when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it. fix this by checking media_id.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < 3998283e4c32c0fe69edd59b0876c193f50abce6 (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < c2e17984752b9131061d1a2ca1199da2706337fd (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < 8595350615f952fcf8bc861464a6bf6b1129af50 (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < 05d332ba075753d569d66333d62d60fff5f57ad8 (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < d3dfe821dfe091c0045044343c8d86596d66e2cf (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < 0d3d91c3500f0c480e016faa4e2259c588616e59 (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < 0f4a72fb266e48dbe928e1d936eab149e4ac3e1b (git)
Affected: 832629ca5c313e122b22b8e73a6d80f111b1a1ae , < f82727adcf2992822e12198792af450a76ebd5ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:09.900Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/udp_media.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3998283e4c32c0fe69edd59b0876c193f50abce6",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "c2e17984752b9131061d1a2ca1199da2706337fd",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "8595350615f952fcf8bc861464a6bf6b1129af50",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "05d332ba075753d569d66333d62d60fff5f57ad8",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "d3dfe821dfe091c0045044343c8d86596d66e2cf",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "0d3d91c3500f0c480e016faa4e2259c588616e59",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "0f4a72fb266e48dbe928e1d936eab149e4ac3e1b",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            },
            {
              "lessThan": "f82727adcf2992822e12198792af450a76ebd5ef",
              "status": "affected",
              "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/udp_media.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer\n\nThe reproduction steps:\n1. create a tun interface\n2. enable l2 bearer\n3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun\n\ntipc: Started in network mode\ntipc: Node identity 8af312d38a21, cluster identity 4711\ntipc: Enabled bearer \u003ceth:syz_tun\u003e, priority 1\nOops: general protection fault\nKASAN: null-ptr-deref in range\nCPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT\nHardware name: QEMU Ubuntu 24.04 PC\nRIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0\n\nthe ub was in fact a struct dev.\n\nwhen bid != 0 \u0026\u0026 skip_cnt != 0, bearer_list[bid] may be NULL or\nother media when other thread changes it.\n\nfix this by checking media_id."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the TIPC generic netlink family (`TIPC_NL_UDP_GET_REMOTEIP` dumpit handler), which requires a local AF_NETLINK socket. No remote packet processing is involved.\nAC:L - The primary path (`bid==0 \u0026\u0026 skip_cnt==0`) is fully deterministic \u2014 enable an eth bearer on any non-loopback netdev, then dump remoteip by that bearer name; no race needs to be won, and the commit\u0027s reproducer is a straightforward three-step PoC.\nPR:L - A local unprivileged account suffices: the TIPC v2 genl ops carry no `GENL_ADMIN_PERM` and the family has no `pre_doit` check, and any residual CAP_NET_ADMIN needed to create the backing netdev is obtainable via `unshare -Urn` since the family is `.netnsok = true`.\nUI:N - The attacker performs every step (bearer enable, netlink dump) from their own process; no victim action or interaction is required.\nS:U - The type confusion and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A `struct net_device` is walked as a `struct udp_bearer` list, and each traversed \"node\" has 20 bytes at `ptr - 56` copied into the netlink reply returned to the caller, disclosing kernel memory; the pointer bytes fall in `tc_to_txq[]`, which the same attacker can influence via tc mqprio, moving this toward a controlled kernel read.\nI:H - This is a genuine type confusion \u2014 a `net_device` is dereferenced as a different object type through a partially attacker-influenceable pointer, which per kernel scoring guidance is treated as High integrity impact.\nA:H - The confirmed and trivially reproducible result is a general protection fault / KASAN null-ptr-deref in `tipc_udp_nl_dump_remoteip()`, i.e. a kernel oops that any local user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:12.781Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3998283e4c32c0fe69edd59b0876c193f50abce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2e17984752b9131061d1a2ca1199da2706337fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8595350615f952fcf8bc861464a6bf6b1129af50"
        },
        {
          "url": "https://git.kernel.org/stable/c/05d332ba075753d569d66333d62d60fff5f57ad8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3dfe821dfe091c0045044343c8d86596d66e2cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d3d91c3500f0c480e016faa4e2259c588616e59"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f4a72fb266e48dbe928e1d936eab149e4ac3e1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f82727adcf2992822e12198792af450a76ebd5ef"
        }
      ],
      "title": "tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38184",
    "datePublished": "2025-07-04T13:37:11.226Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:12.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38184",
      "date": "2026-09-24",
      "epss": "0.00192",
      "percentile": "0.07824"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:54:42.000Z",
      "cve": "CVE-2025-38184",
      "id": "msrc_CVE-2025-38184",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38184.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/udp_media.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3998283e4c32c0fe69edd59b0876c193f50abce6",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c2e17984752b9131061d1a2ca1199da2706337fd",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8595350615f952fcf8bc861464a6bf6b1129af50",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05d332ba075753d569d66333d62d60fff5f57ad8",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3dfe821dfe091c0045044343c8d86596d66e2cf",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d3d91c3500f0c480e016faa4e2259c588616e59",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f4a72fb266e48dbe928e1d936eab149e4ac3e1b",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f82727adcf2992822e12198792af450a76ebd5ef",
                    "status": "affected",
                    "version": "832629ca5c313e122b22b8e73a6d80f111b1a1ae",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/udp_media.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.295",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.239",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.186",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B21DCE7-9C7D-465B-8BFD-724470A8C8ED",
                    "versionEndExcluding": "5.4.295",
                    "versionStartIncluding": "4.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3D14F4C-A21E-465D-A928-5CCE684E2B98",
                    "versionEndExcluding": "5.10.239",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D",
                    "versionEndExcluding": "5.15.186",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1",
                    "versionEndExcluding": "6.1.142",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5E01853-7048-4D78-9479-9AEE41AC8456",
                    "versionEndExcluding": "6.6.95",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C",
                    "versionEndExcluding": "6.12.35",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655",
                    "versionEndExcluding": "6.15.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer\n\nThe reproduction steps:\n1. create a tun interface\n2. enable l2 bearer\n3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun\n\ntipc: Started in network mode\ntipc: Node identity 8af312d38a21, cluster identity 4711\ntipc: Enabled bearer \u003ceth:syz_tun\u003e, priority 1\nOops: general protection fault\nKASAN: null-ptr-deref in range\nCPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT\nHardware name: QEMU Ubuntu 24.04 PC\nRIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0\n\nthe ub was in fact a struct dev.\n\nwhen bid != 0 \u0026\u0026 skip_cnt != 0, bearer_list[bid] may be NULL or\nother media when other thread changes it.\n\nfix this by checking media_id."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: corregir null-ptr-deref al adquirir la IP remota del portador Ethernet Pasos de reproducci\u00f3n: 1. crear una interfaz tun 2. habilitar el portador l2 3. TIPC_NL_UDP_GET_REMOTEIP con el nombre del medio establecido en tun tipc: iniciado en modo de red tipc: identidad del nodo 8af312d38a21, identidad del cl\u00faster 4711 tipc: portador habilitado , prioridad 1 Oops: error de protecci\u00f3n general KASAN: null-ptr-deref en el rango CPU: 1 UID: 1000 PID: 559 Comm: poc No contaminado 6.16.0-rc1+ #117 PREEMPT Nombre del hardware: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 el ub era de hecho un struct dev. cuando bid != 0 y skip_cnt != 0, bearer_list[bid] puede ser NULL u otro medio cuando otro hilo lo cambia. solucione esto comprobando media_id."
          }
        ],
        "id": "CVE-2025-38184",
        "lastModified": "2026-07-30T06:22:58.607",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-04T14:15:25.237",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05d332ba075753d569d66333d62d60fff5f57ad8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d3d91c3500f0c480e016faa4e2259c588616e59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0f4a72fb266e48dbe928e1d936eab149e4ac3e1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3998283e4c32c0fe69edd59b0876c193f50abce6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8595350615f952fcf8bc861464a6bf6b1129af50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c2e17984752b9131061d1a2ca1199da2706337fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3dfe821dfe091c0045044343c8d86596d66e2cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f82727adcf2992822e12198792af450a76ebd5ef"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:16+00:00",
      "cve": "CVE-2025-38184",
      "id": "CVE-2025-38184",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38184.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:01:37Z",
      "cve": "CVE-2025-38184",
      "id": "CVE-2025-38184",
      "initial_release_date": "2025-07-04T23:22:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "551",
      "product_status:known_not_affected": "36",
      "product_status:recommended": "780",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38184",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38184.json",
      "version": "66"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.