CVE-2025-68813 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems, including those who manage Linux kernel updates and vulnerability fixes, and security teams monitoring for similar vulnerabilities in the Linux kernel. They should review and apply the fix to prevent crashes and monitor for similar vulnerabilities in the Linux kernel. Additionally, they should verify and apply the fix to prevent crashes and update Linux

Why it matters

A NULL pointer dereference vulnerability was found in the Linux kernel's IPVS component, which can cause a crash when processing packets in NAT mode with a misconfigured destination.

• Verify and apply the fix to prevent crashes
• Monitor for similar vulnerabilities in the Linux kernel
• Update Linux kernel to the latest version

Technical summary

The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The crash occurs due to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue was resolved by applying a fix similar to the one used for IPv6, setting skb->dev from skb_dst(skb)->dev before calling dst_link_failure().

Defensive priority

Apply the fix from commit 326bf17ea5d4 to set skb->dev from skb_dst(skb)->dev before calling dst_link_failure().

Recommended defensive actions

• Apply the fix from commit 326bf17ea5d4 to set skb->dev from skb_dst(skb)->dev before calling dst_link_failure().
• Review and update Linux kernel to the latest version
• Monitor for similar vulnerabilities in the Linux kernel
• Verify and apply the fix to prevent crashes
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue was resolved by applying a fix similar to the one used for IPv6. The crash occurs due to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.