CVE-2025-22063

What it actually does

NULL pointer dereference in netlabel when netlbl_conn_setattr() is called on an IPv4 socket with an IPv6 address, causing calipso_sock_setattr() to dereference a NULL pinet6 pointer from inet_sk().

Why it matters to the business

Kernel crashes or denial of service on systems running affected QEMU packages, disrupting virtual machine operations and requiring urgent patching of widely deployed Red Hat Enterprise Linux components.

How an attack unfolds

An attacker triggers netlbl_conn_setattr() on an IPv4 socket by supplying an IPv6 address during connect, bypassing family checks and reaching the NULL pinet6 access inside calipso_sock_setattr(); similar kernel privilege-escalation techniques from listed threat actors targeting Linux kernel flaws could be adapted.

How to fix it

Upgrade all listed qemu-* packages on Red Hat Enterprise Linux 9.4 to version 17:8.2.0-11.el9_4.8 or later; apply the kernel patch that adds the inet6_sk(sk) NULL check before accessing pinet6.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases; confirm kernel source contains the inet6_sk() guard in netlabel; test socket connect behavior with mismatched address families.

Typical attack path

1. Identify or create an IPv4 socket
2. Call connect() with an IPv6 address to invoke netlbl_conn_setattr()
3. Trigger calipso_sock_setattr() path that dereferences NULL pinet6
4. Cause kernel oops or panic

How to detect it

Search kernel logs for oops or panic messages mentioning netlabel, calipso_sock_setattr, or pinet6; correlate with processes performing socket connect operations using mixed IPv4/IPv6 addresses.

What your security team should do

• Immediately update all affected QEMU packages to 17:8.2.0-11.el9_4.8
• Prioritize patching in environments using QEMU networking or CALIPSO labeling
• Monitor for kernel oops related to netlabel after changes
• Review similar Linux kernel privilege-escalation CVEs for overlapping exposure