no cvss —

CVE-2025-68813 json

ipvs: fix ipv4 null-ptr-deref in route error path

published 2026-01-13 9 mo ago modified 2026-10-19 20 d ago also EUVD-2026-2288

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages.

The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure().

The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev

Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev from skb_dst(skb)->dev before calling dst_link_failure().

KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f] CPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2 RIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233 RIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285 Call Trace: <TASK> spec_dst_fill net/ipv4/ip_options.c:232 spec_dst_fill net/ipv4/ip_options.c:229 __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330 ipv4_send_dest_unreach net/ipv4/route.c:1252 ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265 dst_link_failure include/net/dst.h:437 __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412 ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764

Patch / fix

fixed in 1 distros 4 links 7

Linux Linux 3.19, 4.5, 4.10, 4.15, 4.20, 5.1, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19

debian ubuntu suse opensuse

linux Debian 12 6.1.162-1
linux Debian 13 6.12.69-1
linux Debian 14 6.18.3-1

debian advisories DEBIAN-CVE-2025-68813

linux Ubuntu 22.04 LTS 5.15.0-173.183
linux Ubuntu 24.04 LTS 6.8.0-110.110
linux Ubuntu 25.10 6.17.0-22.22
linux-aws Ubuntu 22.04 LTS 5.15.0-1103.110
linux-aws Ubuntu 24.04 LTS 6.8.0-1052.55
linux-aws Ubuntu 25.10 6.17.0-1012.12
linux-gcp Ubuntu 22.04 LTS 5.15.0-1103.112
linux-gcp Ubuntu 24.04 LTS 6.8.0-1054.57

ubuntu advisories UBUNTU-CVE-2025-68813

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-livepatch-SLE16_Update_2 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4-160000.1.1
kernel-livepatch-SLE16_Update_1 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6-160000.1.1
kernel-livepatch-SLE16_Update_0 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 8-160000.4.3
kernel-livepatch-SLE16_Update_3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3-160000.1.1
kernel-livepatch-SLE16_Update_4 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2-160000.1.1
kernel-livepatch-SLE15-SP7_Update_7 SLE Live Patching 15 SP7 2-150700.2.1
kernel-livepatch-SLE15-SP7_Update_2 SLE Live Patching 15 SP7 11-150700.2.1
kernel-livepatch-SLE15-SP7_Update_0 SLE Live Patching 15 SP7 12-150700.3.33.1

suse advisories SUSE-SU-2026:1136-1 SUSE-SU-2026:1132-1 SUSE-SU-2026:1125-1 SUSE-SU-2026:1102-1 SUSE-SU-2026:1099-1 SUSE-SU-2026:1096-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.26.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.26.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.26.1

opensuse advisories openSUSE-SU-2026:20287-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-68813 updated 2026-11-07 cvss 5.5

kernel: ipvs: fix ipv4 null-ptr-deref in route error path

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: workaround, no fix available
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago (2026-06-16)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-68813
NVD CVE-2025-68813

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary