CVE-2025-38184

What it actually does

Null pointer dereference in tipc_udp_nl_dump_remoteip when bearer_list[bid] is NULL or mismatched media after concurrent changes, triggered via TIPC_NL_UDP_GET_REMOTEIP netlink request on a tun-backed L2 bearer.

Why it matters to the business

Local users can trigger kernel crashes on affected Linux systems, causing denial of service; in container or multi-tenant environments this can disrupt workloads and require restarts, with low but non-zero exploitability given the 480-day window since disclosure.

How an attack unfolds

An attacker creates a tun interface, enables an L2 TIPC bearer over it, then issues a crafted TIPC_NL_UDP_GET_REMOTEIP netlink message with media name set to tun; when bid and skip_cnt conditions are met under concurrent bearer changes, the handler dereferences a NULL dev pointer leading to a general protection fault.

How to fix it

Update the Linux kernel to commit 3998283e4c32c0fe69edd59b0876c193f50abce6 or later stable releases that add the media_id check before accessing bearer_list entries; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is applied by verifying the media_id validation exists in tipc_udp_nl_dump_remoteip; test by reproducing the original tun + bearer + netlink sequence and ensuring no oops occurs.

Typical attack path

1. Create and configure a tun interface
2. Enable L2 TIPC bearer over the tun device
3. Send TIPC_NL_UDP_GET_REMOTEIP netlink request specifying tun media name
4. Trigger concurrent bearer list modification to induce NULL bearer entry
5. Cause kernel oops via null dereference in tipc_udp_nl_dump_remoteip

How to detect it

Search kernel logs and dmesg for general protection faults or KASAN null-ptr-deref reports referencing tipc_udp_nl_dump_remoteip; correlate with process activity creating tun interfaces and issuing TIPC netlink commands.

What your security team should do

• Prioritize kernel updates on all systems exposing TIPC netlink interfaces, especially container hosts
• Restrict unprivileged access to TIPC netlink sockets via LSM or capabilities where possible
• Monitor for kernel oops logs containing tipc_udp_nl_dump_remoteip
• Apply the fix within standard patch windows given absence from KEV