# CVE-2025-22103

## Summary

- **CVE ID:** CVE-2025-22103
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Apr 16, 2025
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer dereference in l3mdev_l3_rcv

When delete l3s ipvlan:

    ip link del link eth0 ipvlan1 type ipvlan mode l3s

This may cause a null pointer dereference:

    Call trace:
     ip_rcv_finish+0x48/0xd0
     ip_rcv+0x5c/0x100
     __netif_receive_skb_one_core+0x64/0xb0
     __netif_receive_skb+0x20/0x80
     process_backlog+0xb4/0x204
     napi_poll+0xe8/0x294
     net_rx_action+0xd8/0x22c
     __do_softirq+0x12c/0x354

This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after
ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process
like this:

    (CPU1)                     | (CPU2)
    l3mdev_l3_rcv()            |
      check dev->priv_flags:   |
        master = skb->dev;     |
                               |
                               | ipvlan_l3s_unregister()
                               |   set dev->priv_flags
                               |   dev->l3mdev_ops = NULL;
                               |
      visit master->l3mdev_ops |

To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.

## Affected Products

- Linux — Linux (c675e06a98a474f7ad0af32ce467613da818da52)
- Linux — Linux (5.1)
- Linux — Linux (0)
- Linux — Linux (6.6.117)
- Linux — Linux (6.12.46)
- Linux — Linux (6.14.2)
- Linux — Linux (6.15)
- Linux — Linux (5.10.270)
- Linux — Linux (5.15.221)
- Linux — Linux (6.1.188)

## References

- [CNA](https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836)
- [CNA](https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204)
- [CNA](https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132)
- [CNA](https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce)
- [CNA](https://git.kernel.org/stable/c/1da52878f7fb74ace304f74325bb89e3e5546b55)
- [CNA](https://git.kernel.org/stable/c/d97d6b1bd2b7f2a188d261d44c4519a13b8c406a)
- [CNA](https://git.kernel.org/stable/c/8da4d7f9141e8dbd3ece2f0e6930a0ea8812c862)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.20%
- **EPSS Percentile:** 10.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._