CVE-2025-38181

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

syzkaller reported a null-ptr-deref in sock_omalloc() while allocating

a CALIPSO option. [0]

The NULL is of struct sock, which was fetched by sk_to_full_sk() in

calipso_req_setattr().

Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"),

reqsk->rsk_listener could be NULL when SYN Cookie is returned to its

client, as hinted by the leading SYN Cookie log.

Here are 3 options to fix the bug:

1) Return 0 in calipso_req_setattr()

2) Return an error in calipso_req_setattr()

3) Alaways set rsk_listener

1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie

for CALIPSO. 3) is also no go as there have been many efforts to reduce

atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35

("tcp/dccp: do not touch listener sk_refcnt under synflood").

As of the blamed commit, SYN Cookie already did not need r

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References