net: decrease cached dst counters in dst_release
Affects Linux kernel 4.6.0 onward with CONFIG_DST_CACHE enabled and Open vSwitch tunnels in use. Fixed in kernel 6.6.87, 6.12.23, 6.13.11 and 6.14.2.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 6.6.87, 6.12.23, 6.13.11, 6.14.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30 Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
4.6
- KernelLinux
From 4.6.0 · fixed in 6.6.87; From 6.7.0 · fixed in 6.12.23; From 6.13.0 · fixed in 6.13.11; From 6.14.0 · fixed in 6.14.2
References 6
git.kernel.org
Questions about CVE-2025-22057
What does this mean?
The kernel's dst_release path does not correctly decrease cached destination counters, so already-freed dst data can be accessed during network namespace dismantle. This can cause a kernel crash with a paging request error.Source: git.kernel.org
Am I affected, and how do I check?
Kernels from 4.6.0 up to the fixed releases on each branch (6.6.87, 6.12.23, 6.13.11, 6.14.2) are listed as affected, in setups with CONFIG_DST_CACHE enabled and Open vSwitch with tunnels. To check, run uname -r for the kernel version and look for CONFIG_DST_CACHE in the kernel build config, such as /boot/config-$(uname -r).Source: git.kernel.org
What should I do about it?
Update to the fixed release for your branch: 6.6.87, 6.12.23, 6.13.11, or 6.14.2, or a later release.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data