MediumCVE-2025-38147

    Linux Kernel: NULL Pointer Dereference (CVE-2025-38147)

    Published Last modified Sources: Debian LTS, Red Hat, SUSE, Debian, BSI, Msrc Update Guide, EUVD, CVE.org

    Share

    What is affected, what to do

    In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

    Update Linux Kernel to version 5.4.295, Linux Kernel to version 5.10.239, Linux Kernel to version 5.15.186.

    Affected
    • Linux Kernel lt 4.8..5.4.295
    • Linux Kernel lt 5.5..5.10.239
    • Linux Kernel lt 5.11..5.15.186
    • Linux Kernel lt 5.16..6.1.142
    • Linux Kernel lt 6.2..6.6.94
    • Linux Kernel lt 6.7..6.12.34
    • Linux Kernel lt 6.13..6.15.3
    Fixed in
    • Linux Kernel 5.4.295
    • Linux Kernel 5.10.239
    • Linux Kernel 5.15.186
    • Linux Kernel 6.1.142
    • Linux Kernel 6.6.94
    • Linux Kernel 6.12.34
    • Linux Kernel 6.15.3
    • Linux Kernel 6.16

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    5.5

    XIEM Effective CVSS

    Highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    0.0

    CVSS v3

    Severity Not rated on the scale from 0 to 10.

    Source: Debian LTS, Red Hat, SUSE, Debian, BSI, Msrc Update Guide, EUVD, CVE.org

    0.2 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 13.7

    Show all metrics
    Severity
    Medium
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    10.99 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    5.5 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    0.0
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.2 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    13.7
    Elevated — this CVE ranks above at least 10% of all CVEs scored today.
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: none known · not automatable · Technical impact: partial
    Source: CISA Vulnrichment, as of 5 November 2026

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:

    Source: Debian LTS Advisories, redhat_csaf, suse_csaf, Debian Security Advisories, BSI WID Portal, BSI CSAF, Microsoft Security Update Guide, ENISA EUVD, cvelistv5, NVD (NIST), CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    LinuxLinux
    • —
    • 6.2 – < 6.6.94
    • 5.16 – < 6.1.142
    • 5.11 – < 5.15.186
    • 5.5 – < 5.10.239
    • 6.13 – < 6.15.3
    • 6.7 – < 6.12.34
    • 4.8 – < 5.4.295
    • 6.16
    • 6.6.94
    • 6.1.142
    • 5.15.186
    • 5.10.239
    • 6.15.3
    • 6.12.34
    • 5.4.295

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebiandebian_linux11.0
    Linuxdebianlinuxbookworm
    Linuxdebianlinuxbullseye
    Linuxdebianlinux-6.1bullseye
    Linuxlinuxlinux_kernel—

    References & sources

    • git.kernel.orgstable/c/fc2da88411470480b8b7e9177e930cedd893cf56Patch, euvd
    • git.kernel.orgstable/c/0c813dbc851dbf418fdc6dc883fd0592d6c555cdPatch, euvd
    • git.kernel.orgstable/c/26ce90f1ce60b0ff587de8d6aec399aa55cab28ePatch, euvd
    • git.kernel.orgstable/c/c32ebe33626335a536dbbdd09571c06dd9bc1729Patch, euvd
    • git.kernel.orgstable/c/946bfdfcb76ac2bac5b8526447035885ff41c598Patch, euvd
    • git.kernel.orgstable/c/dd8928897594931d6912ef2f7a43e110b4958d3dPatch, euvd
    • git.kernel.orgstable/c/e2ec310c7a50271843c585e27ef14e48c66ce649Patch, euvd
    • git.kernel.orgstable/c/6e9f2df1c550ead7cecb3e450af1105735020c92Patch, euvd
    • lists.debian.orgdebian-lts-announce/2025/10/msg00008.htmlThird-party advisory
    • lists.debian.orgdebian-lts-announce/2025/10/msg00007.htmlThird-party advisory

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedLinux

      Show 24 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://git.kernel.org/stable/c/0c813dbc851dbf418fdc6dc883fd0592d6c555cd
      Referenceadded
      —
      https://git.kernel.org/stable/c/26ce90f1ce60b0ff587de8d6aec399aa55cab28e
      Referenceadded
      —
      https://git.kernel.org/stable/c/6e9f2df1c550ead7cecb3e450af1105735020c92
      Referenceadded
      —
      https://git.kernel.org/stable/c/946bfdfcb76ac2bac5b8526447035885ff41c598
      Referenceadded
      —
      https://git.kernel.org/stable/c/c32ebe33626335a536dbbdd09571c06dd9bc1729
      Referenceadded
      —
      https://git.kernel.org/stable/c/dd8928897594931d6912ef2f7a43e110b4958d3d
      Referenceadded
      —
      https://git.kernel.org/stable/c/e2ec310c7a50271843c585e27ef14e48c66ce649
      Referenceadded
      —
      https://git.kernel.org/stable/c/fc2da88411470480b8b7e9177e930cedd893cf56
      Referenceremoved
      https://git.kernel.org/stable/c/0c813dbc851dbf418fdc6dc883fd0592d6c555cd
      —
      Referenceremoved
      https://git.kernel.org/stable/c/26ce90f1ce60b0ff587de8d6aec399aa55cab28e
      —
      Referenceremoved
      https://git.kernel.org/stable/c/6e9f2df1c550ead7cecb3e450af1105735020c92
      —
      Referenceremoved
      https://git.kernel.org/stable/c/946bfdfcb76ac2bac5b8526447035885ff41c598
      —
      Referenceremoved
      https://git.kernel.org/stable/c/c32ebe33626335a536dbbdd09571c06dd9bc1729
      —
      Referenceremoved
      https://git.kernel.org/stable/c/dd8928897594931d6912ef2f7a43e110b4958d3d
      —
      Referenceremoved
      https://git.kernel.org/stable/c/e2ec310c7a50271843c585e27ef14e48c66ce649
      —
      Referenceremoved
      https://git.kernel.org/stable/c/fc2da88411470480b8b7e9177e930cedd893cf56
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/0c813dbc851dbf418fdc6dc883fd0592d6c555cd Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/26ce90f1ce60b0ff587de8d6aec399aa55cab28e Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/6e9f2df1c550ead7cecb3e450af1105735020c92 Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/946bfdfcb76ac2bac5b8526447035885ff41c598 Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/c32ebe33626335a536dbbdd09571c06dd9bc1729 Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/dd8928897594931d6912ef2f7a43e110b4958d3d Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/e2ec310c7a50271843c585e27ef14e48c66ce649 Types: Patch
      —
      Reference typeremoved
      https://git.kernel.org/stable/c/fc2da88411470480b8b7e9177e930cedd893cf56 Types: Patch
      —

      Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    2. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: none known, automatable: no

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentadded
      —
      {"id":"CVE-2025-38147","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-11-05T20:50:27.165881Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. Record modifiedCVE Program

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
      Referenceadded
      —
      https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
      Referenceremoved
      https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
      —
      Referenceremoved
      https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
      —
      Reference typeremoved
      https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Types: Third Party Advisory
      —
      Reference typeremoved
      https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Types: Third Party Advisory
      —

      Source identifier: af854a3a-2127-422b-91ae-364da2661108

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2025-38147
    <a href="https://intel.neosec.eu/en/cve/CVE-2025-38147"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-38147.svg?lang=en" alt="CVE-2025-38147 – NEOSEC Intel" height="20"></a>