In the Linux kernel, the following vulnerability has been resolved:
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPCNLUDPGETREMOTEIP with media name set to tun
tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipcudpnldumpremoteip+0x4a4/0x8f0
the ub was in fact a struct dev.
when bid != 0 && skipcnt != 0, bearerlist[bid] may be NULL or other media when other thread changes it.
fix this by checking media_id.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82727adcf2992822e12198792af450a76ebd5ef",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-10f7d367",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3998283e4c32c0fe69edd59b0876c193f50abce6",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-2543f444",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8595350615f952fcf8bc861464a6bf6b1129af50",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-31bcbdb8",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4a72fb266e48dbe928e1d936eab149e4ac3e1b",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-41887266",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82727adcf2992822e12198792af450a76ebd5ef",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-4d5507e4",
"signature_type": "Function",
"digest": {
"function_hash": "138420999960604072028022055935157986333",
"length": 1650.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8595350615f952fcf8bc861464a6bf6b1129af50",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-4dd97209",
"signature_type": "Function",
"digest": {
"function_hash": "152751722454024924019570056530010938726",
"length": 1643.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3d91c3500f0c480e016faa4e2259c588616e59",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-5fc3282d",
"signature_type": "Function",
"digest": {
"function_hash": "138420999960604072028022055935157986333",
"length": 1650.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4a72fb266e48dbe928e1d936eab149e4ac3e1b",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-92106904",
"signature_type": "Function",
"digest": {
"function_hash": "138420999960604072028022055935157986333",
"length": 1650.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d332ba075753d569d66333d62d60fff5f57ad8",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-a4ba5ab7",
"signature_type": "Function",
"digest": {
"function_hash": "152751722454024924019570056530010938726",
"length": 1643.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d3d91c3500f0c480e016faa4e2259c588616e59",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-b78d3534",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3998283e4c32c0fe69edd59b0876c193f50abce6",
"target": {
"file": "net/tipc/udp_media.c",
"function": "tipc_udp_nl_dump_remoteip"
},
"id": "CVE-2025-38184-c1661413",
"signature_type": "Function",
"digest": {
"function_hash": "283870787421821286841094522397727423660",
"length": 1681.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d332ba075753d569d66333d62d60fff5f57ad8",
"target": {
"file": "net/tipc/udp_media.c"
},
"id": "CVE-2025-38184-cfc265fb",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123230185441971845675489786684345254099",
"309254827775361603569755081052322316711",
"113228749937879029774643369078691794832",
"219517484695698146891501709524861183206",
"17517095713241052117692251847738086564",
"193850779624211052175565549525663413583",
"246980984987450607063073080463258283721",
"219517484695698146891501709524861183206"
]
},
"deprecated": false,
"signature_version": "v1"
}
]