CVE Intelligence
Unknown

CVE-2025-68813 — ipvs: fix ipv4 null-ptr-deref in route error path

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure(). The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev from skb_dst(skb)->dev before calling dst_link_failure(). KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f] CPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2 RIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233 RIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285 Call Trace: <TASK> spec_dst_fill net/ipv4/ip_options.c:232 spec_dst_fill net/ipv4/ip_options.c:229 __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330 ipv4_send_dest_unreach net/ipv4/route.c:1252 ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265 dst_link_failure include/net/dst.h:437 __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412 ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764

Published Jan 13, 2026 · Updated Oct 13, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 0.2% (30-day exploitation probability)+2
  • Automatable exploitation (SSVC)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.21%
ahead of 10% of scored CVEs · Oct 14, 2026
Affects
Linux
Linux
CVSS base
—
Score not published yet.

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation
None
none · proof-of-concept · active
Automatable
Yes
can an attacker script the kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Linux Linux version 3d988fcddbe7b8673a231958bd2fba61b5a7ced9version 5.1≥ 5.0.10 and < 5.1≥ 4.19.37 and < 4.20≥ 4.14.114 and < 4.15≥ 4.9.171 and < 4.10≥ 4.4.179 and < 4.5≥ 3.18.139 and < 3.19
and 12 more version 6bd1ee0a993fc9574ae43c1994c54a60cb23a380version 8a430e56a6485267a1b2d3747209d26c54d1a34b≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < dd72a93c80408f06327dd2d956eb1a656d0b5903version ff71f99d5fb2daf54340e8b290d0bc4e6b4c1d38version fbf569d2beee2a4a7a0bc8b619c26101d1211a88version 6c2fa855d8178699706b1192db2f1f8102b0ba1e≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < ad891bb3d079a46a821bf2b8867854645191bab0≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < 689a627d14788ad772e0fa24c2e57a23dbc7ce90≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < 25ab24df31f7af843c96a38e0781b9165216e1a8≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < 4729ff0581fbb7ad098b6153b76b6f5aac94618a≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < cdeff10851c37a002d87a035818ebd60fdb74447≥ ed0de45a1008991fdaa27a0152befcb74d126a8b and < 312d7cd88882fc6cadcc08b02287497aaaf94bcd
Vulnerable CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 0.21%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Not enough vector or weakness data: use the affected application’s logs as a starting point.
application logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Record published
    Oct 13, 2026
  • Affected products added · linux/linux
    Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
  • SSVC assessment updated
    Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
  • Source status changed · → Deferred
    Oct 13, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 13, 2026 · NIST National Vulnerability Database
  • CVE published
    Jan 13, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

  • 1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

7 on the record

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

  • CVE-2026-99999 ipv4: validate checksum_start before completing checksum 13h
  • CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 13h
  • CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
  • CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
  • CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
  • CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No CVSS score published by NVD, the CNA, CISA or GitHub so far.
  • No fixed version, patch or mitigation documented.
  • No CWE classification.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2025-68813 is "ipvs: fix ipv4 null-ptr-deref in route error path", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.21% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.