CVE-2025-22057

net: decrease cached dst counters in dst_release

State: Published
Severity: 7.8 High
Published: Apr 16, 2025
Updated: Oct 30, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: decrease cached dst counters in dst_release

Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts:

Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30

Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 973bb0bc6240b55e313248ef3c6aa551ab7bb735Affected d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before ccc331fd5bcae131d2627d5ef099d4a1f6540aeaAffected d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 92a5c18513117be69bc00419dd1724c1940f8fcdAffected d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 836415a8405c9665ae55352fc5ba865c242f5e4fAffected d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before e833e7ad64eb2f63867f65303be49ca30ee8819eAffected d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 3a0a3ff6593d670af2451ec363ccb7b18aec0c0aAffected
LinuxLinux	4.6Affected before 4.6Not affected 6.1.191 through 6.1.Not affected 6.6.87 through 6.6.Not affected 6.12.23 through 6.12.Not affected 6.13.11 through 6.13.Not affected 6.14.2 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 973bb0bc6240b55e313248ef3c6aa551ab7bb735Affected
d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before ccc331fd5bcae131d2627d5ef099d4a1f6540aeaAffected
d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 92a5c18513117be69bc00419dd1724c1940f8fcdAffected
d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 836415a8405c9665ae55352fc5ba865c242f5e4fAffected
d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before e833e7ad64eb2f63867f65303be49ca30ee8819eAffected
d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 to before 3a0a3ff6593d670af2451ec363ccb7b18aec0c0aAffected

LinuxLinux

4.6Affected
before 4.6Not affected
6.1.191 through 6.1.*Not affected
6.6.87 through 6.6.*Not affected
6.12.23 through 6.12.*Not affected
6.13.11 through 6.13.*Not affected
6.14.2 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.