CVE-2025-22103

What it actually does

Race condition in l3mdev_l3_rcv allows concurrent access to dev->l3mdev_ops after ipvlan_l3s_unregister sets it to NULL, resulting in NULL pointer dereference during network receive processing.

Why it matters to the business

Systems using ipvlan in l3s mode may experience kernel crashes leading to temporary loss of network connectivity and service disruption; low urgency given low EPSS and no KEV listing, though widespread Linux kernel use increases exposure across many environments.

How an attack unfolds

An attacker with local or network-adjacent access creates an ipvlan interface in l3s mode and triggers a race between packet reception on one CPU and interface deletion on another, dereferencing a NULL l3mdev_ops pointer and causing a crash.

How to fix it

Apply kernel updates containing the fix for l3mdev_l3_rcv; for listed Red Hat packages on rhel_eus:8.8 update pg_repack to 1.4.6-3.module+el8.5.0+11357+bcc62552, pgaudit to 1.5.0-1.module+el8.4.0+8873+b821c30a, postgres-decoderbufs to 0.10.0-2.module+el8.4.0+8873+b821c30a, and postgresql packages to 13.18-1.module+el8.8.0+22584+ff67aba6.2 or later.

How to confirm the fix worked

Confirm the updated kernel or packages are installed, reproduce the ipvlan delete operation under load, and verify absence of NULL dereference in l3mdev_l3_rcv via kernel logs or crash dumps.

Typical attack path

1. Configure an ipvlan interface in l3s mode linked to a physical device
2. Initiate network traffic that reaches ip_rcv on the affected interface
3. Concurrently execute ip link del to unregister the ipvlan interface
4. Trigger the window where l3mdev_l3_rcv reads the now-NULL l3mdev_ops pointer
5. Cause kernel panic or oops leading to denial of service

How to detect it

Search kernel logs and dmesg for oops or panic traces containing l3mdev_l3_rcv, ip_rcv_finish, and references to NULL pointer dereference during ipvlan unregister operations; correlate with interface deletion events in audit or system logs.

What your security team should do

• Prioritize patching systems that use ipvlan l3s mode even though EPSS remains low
• Monitor for kernel oops involving l3mdev_l3_rcv after applying updates
• Review network interface configurations to identify any l3s ipvlan usage
• Test the fix in staging environments that replicate concurrent interface deletion and packet processing