CVE-2025-22063 — NULL Pointer Dereference in Linux
Severity
5.5MEDIUMNVD
OSV8.8OSV7.1OSV5.9OSV4.4
EPSS
0.1%
top 71.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 16
Latest updateJan 9
Description
In the Linux kernel, the following vulnerability has been resolved:
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
When calling netlbl_conn_setattr(), addr->sa_family is used
to determine the function behavior. If sk is an IPv4 socket,
but the connect function is called with an IPv6 address,
the function calipso_sock_setattr() is triggered.
Inside this function, the following code is executed:
sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;
Since sk is an IPv4 socke…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages9 packages
▶CVEListV5linux/linuxceba1832b1b2da0149c51de62a847c00bca1677a — 1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf+9