CVE-2025-38192

What it actually does

A BPF program that changes skb->protocol from IPv4 to IPv6 without clearing the associated dst entry leaves an IPv4 dst attached; subsequent IPv6 receive processing dereferences a NULL dst pointer in ip6_rcv_core, causing a kernel crash.

Why it matters to the business

Systems running affected kernels with ingress BPF programs performing v4-to-v6 translation can experience unexpected kernel panics and service interruption; low EPSS and absence from KEV indicate limited real-world exploitation so far, though any production Linux environment using such programs should treat the defect as a denial-of-service risk.

How an attack unfolds

An attacker supplies or triggers a not-so-careful NAT46 BPF program at ingress that rewrites the protocol field on multicast or looped-back packets; the kernel then attempts IPv6 receive processing while still holding an IPv4 dst, resulting in the NULL dereference.

How to fix it

Upgrade the Linux kernel to a version containing commit bfa4d86e130a09f67607482e988313430e38f6c4 or later; rebuild and reboot with the patched kernel; where live-patching is available, apply the vendor-supplied kpatch that clears dst entries in protocol-changing BPF helpers.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the vulnerable release; exercise a test BPF program that performs v4-to-v6 protocol rewrite on loopback traffic and verify no NULL dereference occurs; review dmesg for absence of the original crash signature after upgrade.

Typical attack path

1. Deploy or coerce a BPF program that indiscriminately rewrites skb protocol from 4 to 6 on ingress
2. Cause an IPv4 multicast packet to be looped back through the affected interface
3. Trigger netif_rx path so the BPF runs and alters protocol while the original IPv4 dst remains
4. Enter ip6_rcv_core which calls skb_dst() on the stale IPv4 dst, dereferencing NULL

How to detect it

Search kernel logs and crash dumps for the exact NULL pointer dereference stack beginning with ip6_rcv_core after IPv4 multicast output and netif_rx; correlate with presence of custom ingress BPF programs that alter skb protocol; review audit logs for recent attachment of such programs.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• ip6_rcv_core (net/ipv6/ip6_input.c:190:20)
• process_backlog (net/core/dev.c:6186:4)
• netif_rx

What your security team should do

• Prioritize kernel updates on any host that attaches ingress BPF programs performing address-family translation
• Audit existing BPF programs for protocol changes and add explicit dst release logic until kernels are patched
• Monitor EPSS trend and threat-actor chatter for any increase in exploitation attempts