CVE-2025-22063

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

State: Published
Severity: 5.5 Medium
Published: Apr 16, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an IPv6 address, the function calipso_sock_setattr() is triggered. Inside this function, the following code is executed:

sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;

Since sk is an IPv4 socket, pinet6 is NULL, leading to a null pointer dereference.

This patch fixes the issue by checking if inet6_sk(sk) returns a NULL pointer before accessing pinet6.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	ceba1832b1b2da0149c51de62a847c00bca1677a to before 1ad9166cab6a0f5c0b10344a97bdf749ae11dcbfAffected ceba1832b1b2da0149c51de62a847c00bca1677a to before 1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152Affected ceba1832b1b2da0149c51de62a847c00bca1677a to before a7e89541d05b98c79a51c0f95df020f8e82b62edAffected ceba1832b1b2da0149c51de62a847c00bca1677a to before 797e5371cf55463b4530bab3fef5f27f7c6657a8Affected ceba1832b1b2da0149c51de62a847c00bca1677a to before 1927d0bcd5b81e80971bf6b8eba267508bd1c78bAffected ceba1832b1b2da0149c51de62a847c00bca1677a to before 3ba9cf69de50e8abed32b448616c313baa4c5712Affected ceba1832b1b2da0149c51de62a847c00bca1677a to before 9fe3839588db7519030377b7dee3f165e654f6c5Affected ceba1832b1b2da0149c51de62a847c00bca1677a to before 172a8a996a337206970467e871dd995ac07640b1Affected ceba1832b1b2da0149c51de62a847c00bca1677a to before 078aabd567de3d63d37d7673f714e309d369e6e2Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.4.292 through 5.4.Not affected 5.10.236 through 5.10.Not affected 5.15.180 through 5.15.Not affected 6.1.134 through 6.1.Not affected 6.6.87 through 6.6.Not affected 6.12.23 through 6.12.Not affected 6.13.11 through 6.13.Not affected 6.14.2 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

ceba1832b1b2da0149c51de62a847c00bca1677a to before 1ad9166cab6a0f5c0b10344a97bdf749ae11dcbfAffected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152Affected
ceba1832b1b2da0149c51de62a847c00bca1677a to before a7e89541d05b98c79a51c0f95df020f8e82b62edAffected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 797e5371cf55463b4530bab3fef5f27f7c6657a8Affected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 1927d0bcd5b81e80971bf6b8eba267508bd1c78bAffected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 3ba9cf69de50e8abed32b448616c313baa4c5712Affected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 9fe3839588db7519030377b7dee3f165e654f6c5Affected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 172a8a996a337206970467e871dd995ac07640b1Affected
ceba1832b1b2da0149c51de62a847c00bca1677a to before 078aabd567de3d63d37d7673f714e309d369e6e2Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.4.292 through 5.4.*Not affected
5.10.236 through 5.10.*Not affected
5.15.180 through 5.15.*Not affected
6.1.134 through 6.1.*Not affected
6.6.87 through 6.6.*Not affected
6.12.23 through 6.12.*Not affected
6.13.11 through 6.13.*Not affected
6.14.2 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.