CVE-2025-68353None▾ Sunlit

net: vxlan: prevent NULL deref in vxlan_xmit_one

In the Linux kernel, the following vulnerability has been resolved: net: vxlan: prevent NULL deref in vxlan_xmit_one Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlan_xmit_one, e.g. if the iface is brought down. T…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 24, 2025

Updated

Oct 21, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.22% · p13

Platforms

—

Source

CVEORG

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 306 days

Dec 24, 2025Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.2%
Oct 26, 2026EPSS peak
0.2% → 0.2%

Linux #cve.org

Affected

Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 333deb6b43c11d5bce00463b364ac993d2fa02a6
Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 4ac26aafdc8c7271414e2e7c0b2cb266a26591bc
Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 1f73a56f986005f0bc64ed23873930e2ee4f5911
Linux 6.7

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: vxlan: prevent NULL deref in vxlan_xmit_one

Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the following NULL dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:vxlan_xmit_one+0xbb3/0x1580 Call Trace: vxlan_xmit+0x429/0x610 dev_hard_start_xmit+0x55/0xa0 __dev_queue_xmit+0x6d0/0x7f0 ip_finish_output2+0x24b/0x590 ip_output+0x63/0x110

Mentioned commits changed the code path in vxlan_xmit_one and as a side effect the sock4/6 pointer validity checks in vxlan(6)_get_route were lost. Fix this by adding back checks.

Since both commits being fixed were released in the same version (v6.7) and are strongly related, bundle the fixes in a single commit.

Affected

Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 333deb6b43c11d5bce00463b364ac993d2fa02a6
Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 4ac26aafdc8c7271414e2e7c0b2cb266a26591bc
Linux >= 6f19b2c136d98a84d79030b53e23d405edfdc783 < 1f73a56f986005f0bc64ed23873930e2ee4f5911
Linux 6.7

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

net: vxlan: prevent NULL deref in vxlan_xmit_one

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: vxlan: prevent NULL deref in vxlan_xmit_one

Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the following NULL dereference:

Mentioned commits changed the code path in vxlan_xmit_one and as a side effect the sock4/6 pointer validity checks in vxlan(6)_get_route were lost. Fix this by adding back checks.

Since both commits being fixed were released in the same version (v6.7) and are strongly related, bundle the fixes in a single commit.