In the Linux kernel, the following vulnerability has been resolved:
ipvlan: ensure network headers are in skb linear part
syzbot found that ipvlanprocessv6_outbound() was assuming the IPv6 network header isis present in skb->head [1]
Add the needed pskbnetworkmay_pull() calls for both IPv4 and IPv6 handlers.
[1] BUG: KMSAN: uninit-value in _ipv6addrtype+0xa2/0x490 net/ipv6/addrconfcore.c:47 _ipv6addrtype+0xa2/0x490 net/ipv6/addrconfcore.c:47 ipv6addrtype include/net/ipv6.h:555 [inline] ip6routeoutputflagsnoref net/ipv6/route.c:2616 [inline] ip6routeoutputflags+0x51/0x720 net/ipv6/route.c:2651 ip6routeoutput include/net/ip6route.h:93 [inline] ipvlanroutev6outbound+0x24e/0x520 drivers/net/ipvlan/ipvlancore.c:476 ipvlanprocessv6outbound drivers/net/ipvlan/ipvlancore.c:491 [inline] ipvlanprocessoutbound drivers/net/ipvlan/ipvlancore.c:541 [inline] ipvlanxmitmodel3 drivers/net/ipvlan/ipvlancore.c:605 [inline] ipvlanqueuexmit+0xd72/0x1780 drivers/net/ipvlan/ipvlancore.c:671 ipvlanstartxmit+0x5b/0x210 drivers/net/ipvlan/ipvlanmain.c:223 _netdevstartxmit include/linux/netdevice.h:5150 [inline] netdevstartxmit include/linux/netdevice.h:5159 [inline] xmitone net/core/dev.c:3735 [inline] devhardstartxmit+0x247/0xa20 net/core/dev.c:3751 schdirectxmit+0x399/0xd40 net/sched/schgeneric.c:343 qdiscrestart net/sched/schgeneric.c:408 [inline] _qdiscrun+0x14da/0x35d0 net/sched/schgeneric.c:416 qdiscrun+0x141/0x4d0 include/net/pktsched.h:127 nettxaction+0x78b/0x940 net/core/dev.c:5484 handlesoftirqs+0x1a0/0x7c0 kernel/softirq.c:561 _dosoftirq+0x14/0x1a kernel/softirq.c:595 dosoftirq+0x9a/0x100 kernel/softirq.c:462 _localbhenableip+0x9f/0xb0 kernel/softirq.c:389 localbhenable include/linux/bottomhalf.h:33 [inline] rcureadunlockbh include/linux/rcupdate.h:919 [inline] _devqueuexmit+0x2758/0x57d0 net/core/dev.c:4611 devqueuexmit include/linux/netdevice.h:3311 [inline] packetxmit+0x9c/0x6c0 net/packet/afpacket.c:276 packetsnd net/packet/afpacket.c:3132 [inline] packetsendmsg+0x93e0/0xa7e0 net/packet/afpacket.c:3164 socksendmsg_nosec net/socket.c:718 [inline]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8dea8d1612dc7151d2457d7d2e6a69820309bf",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-1062e258",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 468.0,
"function_hash": "301417797042087024946025979154451500833"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27843ce6ba3d3122b65066550fe33fb8839f8aef",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-23849a0d",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 468.0,
"function_hash": "301417797042087024946025979154451500833"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27843ce6ba3d3122b65066550fe33fb8839f8aef",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2025-21891-26a8a94b",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"line_hashes": [
"49583570563353289498563750095022820111",
"279588605499258310942584576737536733990",
"84676868409845379762697350594395224300",
"134601938383929804574820006997958936383",
"284308627551324813356216982271838258352",
"197769566465128177404758361698700296648",
"22298054073720673633246913418882153549",
"34419620142289395453442594346962234869",
"193414331103992589782231999544906215654",
"295993304552376654786966885744653970422",
"308216024973290282605314031487057031472",
"302759223752692928931228869788543034790",
"107560805355107251090703677757871981134",
"94560209599198831397929260093385374036",
"127967309704033129404346447016277416335",
"268797080091554214390489014620201813877",
"251858084822847493130670966373703542323",
"288720755975767955850289188336714438803",
"337868295794411833110241620936772295412"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a4f76a2d8a44816ecd25bcbdb47b786d621974",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-32ad72b0",
"target": {
"function": "ipvlan_process_v4_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 921.0,
"function_hash": "258440543746291890718943262765690920698"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5353fd89663c48f56bdff975c562cfe78b1a2e4c",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-5e98674a",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 468.0,
"function_hash": "301417797042087024946025979154451500833"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5353fd89663c48f56bdff975c562cfe78b1a2e4c",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2025-21891-6339c641",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"line_hashes": [
"49583570563353289498563750095022820111",
"279588605499258310942584576737536733990",
"84676868409845379762697350594395224300",
"134601938383929804574820006997958936383",
"284308627551324813356216982271838258352",
"197769566465128177404758361698700296648",
"22298054073720673633246913418882153549",
"34419620142289395453442594346962234869",
"193414331103992589782231999544906215654",
"295993304552376654786966885744653970422",
"308216024973290282605314031487057031472",
"302759223752692928931228869788543034790",
"107560805355107251090703677757871981134",
"94560209599198831397929260093385374036",
"127967309704033129404346447016277416335",
"268797080091554214390489014620201813877",
"251858084822847493130670966373703542323",
"288720755975767955850289188336714438803",
"337868295794411833110241620936772295412"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5353fd89663c48f56bdff975c562cfe78b1a2e4c",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-809c2e3b",
"target": {
"function": "ipvlan_process_v4_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 921.0,
"function_hash": "258440543746291890718943262765690920698"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a4f76a2d8a44816ecd25bcbdb47b786d621974",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2025-21891-91687d70",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"line_hashes": [
"49583570563353289498563750095022820111",
"279588605499258310942584576737536733990",
"84676868409845379762697350594395224300",
"134601938383929804574820006997958936383",
"284308627551324813356216982271838258352",
"197769566465128177404758361698700296648",
"22298054073720673633246913418882153549",
"34419620142289395453442594346962234869",
"193414331103992589782231999544906215654",
"295993304552376654786966885744653970422",
"308216024973290282605314031487057031472",
"302759223752692928931228869788543034790",
"107560805355107251090703677757871981134",
"94560209599198831397929260093385374036",
"127967309704033129404346447016277416335",
"268797080091554214390489014620201813877",
"251858084822847493130670966373703542323",
"288720755975767955850289188336714438803",
"337868295794411833110241620936772295412"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8dea8d1612dc7151d2457d7d2e6a69820309bf",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2025-21891-97cec38b",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"line_hashes": [
"49583570563353289498563750095022820111",
"279588605499258310942584576737536733990",
"84676868409845379762697350594395224300",
"134601938383929804574820006997958936383",
"284308627551324813356216982271838258352",
"197769566465128177404758361698700296648",
"22298054073720673633246913418882153549",
"34419620142289395453442594346962234869",
"193414331103992589782231999544906215654",
"295993304552376654786966885744653970422",
"308216024973290282605314031487057031472",
"302759223752692928931228869788543034790",
"107560805355107251090703677757871981134",
"94560209599198831397929260093385374036",
"127967309704033129404346447016277416335",
"268797080091554214390489014620201813877",
"251858084822847493130670966373703542323",
"288720755975767955850289188336714438803",
"337868295794411833110241620936772295412"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ec48f812804f370f622e0874e6dd8fcc58241cd",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2025-21891-a8862ca1",
"target": {
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"line_hashes": [
"49583570563353289498563750095022820111",
"279588605499258310942584576737536733990",
"84676868409845379762697350594395224300",
"134601938383929804574820006997958936383",
"284308627551324813356216982271838258352",
"197769566465128177404758361698700296648",
"22298054073720673633246913418882153549",
"34419620142289395453442594346962234869",
"193414331103992589782231999544906215654",
"295993304552376654786966885744653970422",
"308216024973290282605314031487057031472",
"302759223752692928931228869788543034790",
"107560805355107251090703677757871981134",
"94560209599198831397929260093385374036",
"127967309704033129404346447016277416335",
"268797080091554214390489014620201813877",
"251858084822847493130670966373703542323",
"288720755975767955850289188336714438803",
"337868295794411833110241620936772295412"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ec48f812804f370f622e0874e6dd8fcc58241cd",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-b7c9542f",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 468.0,
"function_hash": "301417797042087024946025979154451500833"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ec48f812804f370f622e0874e6dd8fcc58241cd",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-bc404cc3",
"target": {
"function": "ipvlan_process_v4_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 921.0,
"function_hash": "258440543746291890718943262765690920698"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27843ce6ba3d3122b65066550fe33fb8839f8aef",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-cb9511e7",
"target": {
"function": "ipvlan_process_v4_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 921.0,
"function_hash": "258440543746291890718943262765690920698"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a4f76a2d8a44816ecd25bcbdb47b786d621974",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-fe9fffcc",
"target": {
"function": "ipvlan_process_v6_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 468.0,
"function_hash": "301417797042087024946025979154451500833"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8dea8d1612dc7151d2457d7d2e6a69820309bf",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2025-21891-fede150c",
"target": {
"function": "ipvlan_process_v4_outbound",
"file": "drivers/net/ipvlan/ipvlan_core.c"
},
"digest": {
"length": 921.0,
"function_hash": "258440543746291890718943262765690920698"
},
"deprecated": false
}
]