CVE-2025-22063

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

Description

In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an IPv6 address, the function calipso_sock_setattr() is triggered. Inside this function, the following code is executed: sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL; Since sk is an IPv4 socket, pinet6 is NULL, leading to a null pointer dereference. This patch fixes the issue by checking if inet6_sk(sk) returns a NULL pointer before accessing pinet6.

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf patch
https://git.kernel.org/stable/c/1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152 patch
https://git.kernel.org/stable/c/a7e89541d05b98c79a51c0f95df020f8e82b62ed patch
https://git.kernel.org/stable/c/797e5371cf55463b4530bab3fef5f27f7c6657a8 patch
https://git.kernel.org/stable/c/1927d0bcd5b81e80971bf6b8eba267508bd1c78b patch
https://git.kernel.org/stable/c/3ba9cf69de50e8abed32b448616c313baa4c5712 patch
https://git.kernel.org/stable/c/9fe3839588db7519030377b7dee3f165e654f6c5 patch
https://git.kernel.org/stable/c/172a8a996a337206970467e871dd995ac07640b1 patch
https://git.kernel.org/stable/c/078aabd567de3d63d37d7673f714e309d369e6e2 patch

Frequently Asked Questions

What is the severity of CVE-2025-22063?
CVE-2025-22063 has been scored as a medium severity vulnerability.
How to fix CVE-2025-22063?
To fix CVE-2025-22063, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-22063 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-22063 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-22063?
CVE-2025-22063 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.