CVE-2025-68813

What it actually does

Null pointer dereference in the IPv4 IPVS route error path when __ip_vs_get_out_rt() invokes dst_link_failure() with skb->dev unset, causing fib_compute_spec_dst() to crash during ICMP unreachable handling after recent ip_options changes.

Why it matters to the business

Kernel panic on systems running IPVS in NAT mode under route lookup failure conditions, resulting in denial of service, service disruption, and potential loss of availability for load-balanced workloads; low exploitability but high impact on affected kernels.

How an attack unfolds

An attacker or misconfigured traffic sends packets that IPVS processes in NAT mode; when the destination route lookup fails in __ip_vs_get_out_rt(), the error path calls dst_link_failure() without skb->dev, triggering the dereference chain through ipv4_link_failure and fib_compute_spec_dst() and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit dd72a93c80408f06327dd2d956eb1a656d0b5903 which applies the skb->dev assignment from skb_dst(skb)->dev before dst_link_failure, matching the prior IPv6 fix.

How to confirm the fix worked

Confirm the kernel source contains dd72a93c80408f06327dd2d956eb1a656d0b5903 or later; reproduce the original crash scenario with KASAN enabled and verify the panic no longer occurs; check kernel version strings against the fixed commit.

Typical attack path

1. Send IPv4 packet to IPVS virtual service configured for NAT
2. Trigger route lookup failure in __ip_vs_get_out_rt() before a valid dst is established
3. Error path executes dst_link_failure(skb) with skb->dev remaining NULL
4. ipv4_link_failure calls into __ip_options_compile and fib_compute_spec_dst which dereferences the null skb->dev
5. Kernel panics with KASAN null-ptr-deref

How to detect it

Inspect kernel logs and dmesg for KASAN null-ptr-deref reports containing the call trace __ip_vs_get_out_rt, dst_link_failure, ipv4_link_failure, __ip_options_compile, and fib_compute_spec_dst; correlate with IPVS NAT traffic and route errors around the time of the crash.

• KASAN: null-ptr-deref in range
• RIP: fib_compute_spec_dst+0x17a
• __ip_vs_get_out_rt+0x15fd
• ip_vs_nat_xmit+0x1d8
• dst_link_failure include/net/dst.h:437

What your security team should do

• Prioritize kernel upgrades on all systems using IPVS NAT forwarding
• Monitor for route lookup failures or misconfigured real-server destinations that could trigger the path
• Apply the fix or backport the skb->dev assignment immediately on long-lived kernel branches
• Test IPVS configurations with deliberate route failure cases after patching