---
id: CVE-2025-38184
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

  The reproduction steps:
  1
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

  The reproduction steps:
  1. create a tun interface
  2. enable l2 bearer
  3. TIPC_NL_UDP_GET_REMOTEIP …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.9, < 5.4.295'
  - 'linux_kernel >= 5.5, < 5.10.239'
  - 'linux_kernel >= 5.11, < 5.15.186'
  - 'linux_kernel >= 5.16, < 6.1.142'
  - 'linux_kernel >= 6.2, < 6.6.95'
  - 'linux_kernel >= 6.7, < 6.12.35'
  - 'linux_kernel >= 6.13, < 6.15.4'
  - linux_kernel = 6.16
  - debian_linux = 11.0
patched:
  - linux_kernel 6.15.4
published: '2025-07-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:33.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38184'
references:
  - url: 'https://git.kernel.org/stable/c/05d332ba075753d569d66333d62d60fff5f57ad8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0d3d91c3500f0c480e016faa4e2259c588616e59'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0f4a72fb266e48dbe928e1d936eab149e4ac3e1b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3998283e4c32c0fe69edd59b0876c193f50abce6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8595350615f952fcf8bc861464a6bf6b1129af50'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c2e17984752b9131061d1a2ca1199da2706337fd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d3dfe821dfe091c0045044343c8d86596d66e2cf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f82727adcf2992822e12198792af450a76ebd5ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00205
epssPercentile: 0.1037
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:48:17.782889Z'
ingestedAt: '2026-10-15T22:48:25.497Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

The reproduction steps:
1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun

tipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer <eth:syz_tun>, priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0

the ub was in fact a struct dev.

when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
other media when other thread changes it.

fix this by checking media_id.

## Affected

- `linux_kernel >= 4.9, < 5.4.295`
- `linux_kernel >= 5.5, < 5.10.239`
- `linux_kernel >= 5.11, < 5.15.186`
- `linux_kernel >= 5.16, < 6.1.142`
- `linux_kernel >= 6.2, < 6.6.95`
- `linux_kernel >= 6.7, < 6.12.35`
- `linux_kernel >= 6.13, < 6.15.4`
- `linux_kernel = 6.16`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.4`