In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30 Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/3a0a3ff6593d670af2451ec363ccb7b18aec0c0a cve-icon cve-icon
https://git.kernel.org/stable/c/836415a8405c9665ae55352fc5ba865c242f5e4f cve-icon cve-icon
https://git.kernel.org/stable/c/92a5c18513117be69bc00419dd1724c1940f8fcd cve-icon cve-icon
https://git.kernel.org/stable/c/ccc331fd5bcae131d2627d5ef099d4a1f6540aea cve-icon cve-icon
https://git.kernel.org/stable/c/e833e7ad64eb2f63867f65303be49ca30ee8819e cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025041605-CVE-2025-22057-fb12@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-22057 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-22057 cve-icon
History

Wed, 30 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Thu, 17 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 16 Apr 2025 14:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30 Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.
Title net: decrease cached dst counters in dst_release
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-04-16T14:12:14.234Z

Updated: 2025-05-04T07:28:45.671Z

Reserved: 2024-12-29T08:45:45.812Z

Link: CVE-2025-22057

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-04-16T15:15:59.183

Modified: 2025-04-17T20:22:16.240

Link: CVE-2025-22057

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-16T00:00:00Z

Links: CVE-2025-22057 - Bugzilla