LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 the ub was in fact a struct dev. when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it. fix this by checking media_id.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux’s TIPC networking subsystem can make the kernel access an invalid pointer during a local remote-IP query, causing a system crash. The supplied CVSS score is 7.8, but the demonstrated outcome is a crash; broader compromise is not established. Exploitation requires local access and specific TIPC and network-interface conditions.

Executive priority

Prioritize prompt remediation on multi-user hosts, shared compute, and systems running less-trusted workloads with TIPC or network-configuration access. Internet-facing status alone does not increase reachability because the documented attack vector is local. Systems without TIPC usage or accessible configuration paths can follow normal expedited kernel maintenance after confirming exposure.

Technical view

A concurrent bearer change can leave TIPC’s bearer list entry null or associated with another media type while processing a remote-IP netlink request. The resulting invalid interpretation causes a kernel null-pointer dereference. The upstream correction validates the bearer’s media identifier before use. The report reproduced the fault on a 6.16 release candidate.

Likely exposure

Exposure is concentrated on systems running affected Linux kernels where TIPC is available and a local actor can configure the required interface and bearer conditions. This is not described as an unauthenticated internet attack. The supplied affected-version data spans multiple kernel lines but contains ambiguous entries, so distribution-specific advisories should determine actual exposure.

Exploitation context

The supplied sources provide a reproducer and kernel crash trace, demonstrating technical feasibility under controlled local conditions. They do not establish malicious exploitation in the wild, and the KEV flag is false. CVSS describes local, low-complexity exploitation requiring low privileges and no user interaction, although practical configuration permissions may further constrain reachability.

Researcher notes

The core issue is an unsafe assumption about bearer-list stability and media type during concurrent changes. The correction checks media_id before interpreting the entry. The source bundle demonstrates a denial-of-service crash, while the CVSS vector assigns high confidentiality, integrity, and availability impacts. No supplied evidence proves code execution, data disclosure, or active exploitation.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix or distribution backport.
  • Follow the Linux distribution’s advisory because the supplied version mapping contains ambiguous entries.
  • Reboot into the updated kernel and remove superseded vulnerable kernels where operational policy permits.
  • If updating is delayed, restrict untrusted local access and permissions enabling relevant network configuration.
  • Assess disabling unused TIPC functionality as temporary risk reduction, following vendor guidance.

Validation and detection

  • Inventory running kernel releases and compare them with distribution-specific fixed package versions.
  • Confirm whether TIPC is enabled, loaded, configured, or operationally required on each system.
  • Identify workloads permitted to create relevant interfaces or administer TIPC bearers.
  • After remediation, verify the running kernel is the updated version, not merely the installed package.
  • Review kernel logs for protection faults referencing tipc_udp_nl_dump_remoteip; absence does not prove safety.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38184 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38184Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1ae, 832629ca5c313e122b22b8e73a6d80f111b1a1aeunaffected
LinuxLinux4.9, 0, 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.