In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix uninit-value for saddr in dooutputroute4
syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr.
[1] BUG: KMSAN: uninit-value in dooutputroute4+0x42c/0x4d0 net/netfilter/ipvs/ipvsxmit.c:147 dooutputroute4+0x42c/0x4d0 net/netfilter/ipvs/ipvsxmit.c:147 ipvsgetoutrt+0x403/0x21d0 net/netfilter/ipvs/ipvsxmit.c:330 ipvstunnelxmit+0x205/0x2380 net/netfilter/ipvs/ipvsxmit.c:1136 ipvsinhook+0x1aa5/0x35b0 net/netfilter/ipvs/ipvscore.c:2063 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf7/0x400 net/netfilter/core.c:626 nfhook include/linux/netfilter.h:269 [inline] _iplocalout+0x758/0x7e0 net/ipv4/ipoutput.c:118 iplocalout net/ipv4/ipoutput.c:127 [inline] ipsendskb+0x6a/0x3c0 net/ipv4/ipoutput.c:1501 udpsendskb+0xfda/0x1b70 net/ipv4/udp.c:1195 udpsendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inetsendmsg+0x1fc/0x280 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg+0x267/0x380 net/socket.c:727 _syssendmsg+0x91b/0xda0 net/socket.c:2566 _syssendmsg+0x28d/0x3c0 net/socket.c:2620 _syssendmmsg+0x41d/0x880 net/socket.c:2702 _compatsyssendmmsg net/compat.c:360 [inline] _docompatsyssendmmsg net/compat.c:367 [inline] _secompatsyssendmmsg net/compat.c:364 [inline] _ia32compatsyssendmmsg+0xc8/0x140 net/compat.c:364 ia32syscall+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls32.h:346 dosyscall32irqson arch/x86/entry/syscall32.c:83 [inline] _dofastsyscall32+0xb0/0x110 arch/x86/entry/syscall32.c:306 dofastsyscall32+0x38/0x80 arch/x86/entry/syscall32.c:331 doSYSENTER32+0x1f/0x30 arch/x86/entry/syscall32.c:369 entrySYSENTERcompatafter_hwframe+0x84/0x8e
Uninit was created at: slabpostallochook mm/slub.c:4167 [inline] slaballocnode mm/slub.c:4210 [inline] kmalloccachenoprof+0x8fa/0xe00 mm/slub.c:4367 kmallocnoprof include/linux/slab.h:905 [inline] ipvsdestdstalloc net/netfilter/ipvs/ipvsxmit.c:61 [inline] _ipvsgetoutrt+0x35d/0x21d0 net/netfilter/ipvs/ipvsxmit.c:323 ipvstunnelxmit+0x205/0x2380 net/netfilter/ipvs/ipvsxmit.c:1136 ipvsinhook+0x1aa5/0x35b0 net/netfilter/ipvs/ipvscore.c:2063 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf7/0x400 net/netfilter/core.c:626 nfhook include/linux/netfilter.h:269 [inline] _iplocalout+0x758/0x7e0 net/ipv4/ipoutput.c:118 iplocalout net/ipv4/ipoutput.c:127 [inline] ipsendskb+0x6a/0x3c0 net/ipv4/ipoutput.c:1501 udpsendskb+0xfda/0x1b70 net/ipv4/udp.c:1195 udpsendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inetsendmsg+0x1fc/0x280 net/ipv4/afinet.c:851 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg+0x267/0x380 net/socket.c:727 syssendmsg+0x91b/0xda0 net/socket.c:2566 _syssendmsg+0x28d/0x3c0 net/socket.c:2620 _syssendmmsg+0x41d/0x880 net/socket.c:2702 _compatsyssendmmsg net/compat.c:360 [inline] _docompatsyssendmmsg net/compat.c:367 [inline] _secompatsyssendmmsg net/compat.c:364 [inline] _ia32compatsyssendmmsg+0xc8/0x140 net/compat.c:364 ia32syscall+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls32.h:346 dosyscall32irqson arch/x86/entry/syscall32.c:83 [inline] _dofastsyscall32+0xb0/0x110 arch/x86/entry/syscall32.c:306 dofastsyscall32+0x38/0x80 arch/x86/entry/syscall32.c:331 doSYSENTER32+0x1f/0x30 arch/x86/entry/syscall32.c:369 entrySYSENTERcompatafter_hwframe+0x84/0x8e
CPU: 0 UID: 0 PID: 22408 Comm: syz.4.5165 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(undef) Hardware name: Google Google Compute Engi ---truncated---
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37961.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37961.json"
[
{
"digest": {
"function_hash": "112586660666542424215078704730397815259",
"length": 2668.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "__ip_vs_get_out_rt"
},
"signature_type": "Function",
"id": "CVE-2025-37961-033e8b92",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3a1b784791a3cbfc6e05c4d8a3c321ac5136e25",
"deprecated": false
},
{
"digest": {
"function_hash": "228832134704853880028519505598172796098",
"length": 815.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "do_output_route4"
},
"signature_type": "Function",
"id": "CVE-2025-37961-1581e426",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d0032112a0380d0b8d7c9005f621928a9b9fc76",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"238229357893071437346798321048518081137",
"11955464311581009614968533989614787622",
"251360001303806838740623366754294341161",
"239873298024578653404203508503377566457",
"127340295091726688790577877881476509517",
"193261796515558982564382074725354987430",
"201870949064559904772236925458173895456",
"33702982078455523468952507503389138902",
"68134158754039325731897657748936098334",
"20806057003480486907467750901061873892",
"258050303243368344252388042262960067189",
"299454298616082692918723883536756756898",
"136532330311666704876647385331287848111",
"26769233327305001527792671891984541592",
"251516256443744346278724113887658477427",
"294596071254082866006166602199868927138",
"44123097273450812300930639781937910857",
"323575208907687991298068880098117825539",
"238797186738342034853683495879612014117",
"251508621000385400944031961387303249575",
"203720747607038360198997327604150795125",
"129469875299155862790994639508268278458",
"1741408931555070296776883988762792989",
"104269472406583667661610471632824709086",
"5666662756678726246385970583580170979",
"234633874245789766666235084116380491598",
"154065911727362118337857682525967019647",
"173642921140429589294758366889340231475",
"330070810614922292330936088109936139809",
"322496289667194905307270753035278250606",
"339576479347264022451433844291324436468",
"307415991747331890308112501387377554999",
"331960769553118902504774005548446298115",
"103518613928960336428029911682559896538",
"111383409649779339965015561289473776397",
"263411053717820038232096070552643990893",
"200509525874240984242763393748062013994",
"41952820148020688161494400387331579268",
"152803170794301815009493856382764984922"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c"
},
"signature_type": "Line",
"id": "CVE-2025-37961-203f01c7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34090d7214e0516eb8722aee295cb2507317c07",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"238229357893071437346798321048518081137",
"11955464311581009614968533989614787622",
"251360001303806838740623366754294341161",
"239873298024578653404203508503377566457",
"127340295091726688790577877881476509517",
"193261796515558982564382074725354987430",
"201870949064559904772236925458173895456",
"33702982078455523468952507503389138902",
"68134158754039325731897657748936098334",
"20806057003480486907467750901061873892",
"258050303243368344252388042262960067189",
"299454298616082692918723883536756756898",
"136532330311666704876647385331287848111",
"26769233327305001527792671891984541592",
"251516256443744346278724113887658477427",
"294596071254082866006166602199868927138",
"44123097273450812300930639781937910857",
"323575208907687991298068880098117825539",
"238797186738342034853683495879612014117",
"251508621000385400944031961387303249575",
"203720747607038360198997327604150795125",
"129469875299155862790994639508268278458",
"1741408931555070296776883988762792989",
"104269472406583667661610471632824709086",
"5666662756678726246385970583580170979",
"234633874245789766666235084116380491598",
"154065911727362118337857682525967019647",
"173642921140429589294758366889340231475",
"330070810614922292330936088109936139809",
"322496289667194905307270753035278250606",
"339576479347264022451433844291324436468",
"307415991747331890308112501387377554999",
"331960769553118902504774005548446298115",
"103518613928960336428029911682559896538",
"111383409649779339965015561289473776397",
"263411053717820038232096070552643990893",
"200509525874240984242763393748062013994",
"41952820148020688161494400387331579268",
"152803170794301815009493856382764984922"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c"
},
"signature_type": "Line",
"id": "CVE-2025-37961-4f97160f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adbc8cc1162951cb152ed7f147d5fbd35ce3e62f",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"238229357893071437346798321048518081137",
"11955464311581009614968533989614787622",
"251360001303806838740623366754294341161",
"239873298024578653404203508503377566457",
"127340295091726688790577877881476509517",
"193261796515558982564382074725354987430",
"201870949064559904772236925458173895456",
"33702982078455523468952507503389138902",
"68134158754039325731897657748936098334",
"20806057003480486907467750901061873892",
"258050303243368344252388042262960067189",
"299454298616082692918723883536756756898",
"136532330311666704876647385331287848111",
"26769233327305001527792671891984541592",
"251516256443744346278724113887658477427",
"294596071254082866006166602199868927138",
"44123097273450812300930639781937910857",
"323575208907687991298068880098117825539",
"238797186738342034853683495879612014117",
"251508621000385400944031961387303249575",
"203720747607038360198997327604150795125",
"129469875299155862790994639508268278458",
"1741408931555070296776883988762792989",
"104269472406583667661610471632824709086",
"5666662756678726246385970583580170979",
"234633874245789766666235084116380491598",
"154065911727362118337857682525967019647",
"173642921140429589294758366889340231475",
"330070810614922292330936088109936139809",
"322496289667194905307270753035278250606",
"339576479347264022451433844291324436468",
"307415991747331890308112501387377554999",
"331960769553118902504774005548446298115",
"103518613928960336428029911682559896538",
"111383409649779339965015561289473776397",
"263411053717820038232096070552643990893",
"200509525874240984242763393748062013994",
"41952820148020688161494400387331579268",
"152803170794301815009493856382764984922"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c"
},
"signature_type": "Line",
"id": "CVE-2025-37961-5d0ab32c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3a1b784791a3cbfc6e05c4d8a3c321ac5136e25",
"deprecated": false
},
{
"digest": {
"function_hash": "112586660666542424215078704730397815259",
"length": 2668.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "__ip_vs_get_out_rt"
},
"signature_type": "Function",
"id": "CVE-2025-37961-8038df5a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0160ac84fb03a0bd8dce8a42cb25bfaeedd110f4",
"deprecated": false
},
{
"digest": {
"function_hash": "228832134704853880028519505598172796098",
"length": 815.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "do_output_route4"
},
"signature_type": "Function",
"id": "CVE-2025-37961-88140c18",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3a1b784791a3cbfc6e05c4d8a3c321ac5136e25",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"238229357893071437346798321048518081137",
"11955464311581009614968533989614787622",
"251360001303806838740623366754294341161",
"239873298024578653404203508503377566457",
"127340295091726688790577877881476509517",
"193261796515558982564382074725354987430",
"201870949064559904772236925458173895456",
"33702982078455523468952507503389138902",
"68134158754039325731897657748936098334",
"20806057003480486907467750901061873892",
"258050303243368344252388042262960067189",
"299454298616082692918723883536756756898",
"136532330311666704876647385331287848111",
"26769233327305001527792671891984541592",
"251516256443744346278724113887658477427",
"294596071254082866006166602199868927138",
"44123097273450812300930639781937910857",
"323575208907687991298068880098117825539",
"238797186738342034853683495879612014117",
"251508621000385400944031961387303249575",
"203720747607038360198997327604150795125",
"129469875299155862790994639508268278458",
"1741408931555070296776883988762792989",
"104269472406583667661610471632824709086",
"5666662756678726246385970583580170979",
"234633874245789766666235084116380491598",
"154065911727362118337857682525967019647",
"173642921140429589294758366889340231475",
"330070810614922292330936088109936139809",
"322496289667194905307270753035278250606",
"339576479347264022451433844291324436468",
"307415991747331890308112501387377554999",
"331960769553118902504774005548446298115",
"103518613928960336428029911682559896538",
"111383409649779339965015561289473776397",
"263411053717820038232096070552643990893",
"200509525874240984242763393748062013994",
"41952820148020688161494400387331579268",
"152803170794301815009493856382764984922"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c"
},
"signature_type": "Line",
"id": "CVE-2025-37961-9afff786",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d0032112a0380d0b8d7c9005f621928a9b9fc76",
"deprecated": false
},
{
"digest": {
"function_hash": "228832134704853880028519505598172796098",
"length": 815.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "do_output_route4"
},
"signature_type": "Function",
"id": "CVE-2025-37961-a81f6926",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34090d7214e0516eb8722aee295cb2507317c07",
"deprecated": false
},
{
"digest": {
"function_hash": "228832134704853880028519505598172796098",
"length": 815.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "do_output_route4"
},
"signature_type": "Function",
"id": "CVE-2025-37961-c45ed66f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adbc8cc1162951cb152ed7f147d5fbd35ce3e62f",
"deprecated": false
},
{
"digest": {
"function_hash": "232235734648588593926627053720110139437",
"length": 2615.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "__ip_vs_get_out_rt"
},
"signature_type": "Function",
"id": "CVE-2025-37961-d790823c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adbc8cc1162951cb152ed7f147d5fbd35ce3e62f",
"deprecated": false
},
{
"digest": {
"function_hash": "112586660666542424215078704730397815259",
"length": 2668.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "__ip_vs_get_out_rt"
},
"signature_type": "Function",
"id": "CVE-2025-37961-dda6de1c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e34090d7214e0516eb8722aee295cb2507317c07",
"deprecated": false
},
{
"digest": {
"function_hash": "228832134704853880028519505598172796098",
"length": 815.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "do_output_route4"
},
"signature_type": "Function",
"id": "CVE-2025-37961-ed3d0c24",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0160ac84fb03a0bd8dce8a42cb25bfaeedd110f4",
"deprecated": false
},
{
"digest": {
"function_hash": "113253239589112624129907014002144015770",
"length": 2615.0
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c",
"function": "__ip_vs_get_out_rt"
},
"signature_type": "Function",
"id": "CVE-2025-37961-f4b3d386",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d0032112a0380d0b8d7c9005f621928a9b9fc76",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"238229357893071437346798321048518081137",
"11955464311581009614968533989614787622",
"251360001303806838740623366754294341161",
"239873298024578653404203508503377566457",
"127340295091726688790577877881476509517",
"193261796515558982564382074725354987430",
"201870949064559904772236925458173895456",
"33702982078455523468952507503389138902",
"68134158754039325731897657748936098334",
"20806057003480486907467750901061873892",
"258050303243368344252388042262960067189",
"299454298616082692918723883536756756898",
"136532330311666704876647385331287848111",
"26769233327305001527792671891984541592",
"251516256443744346278724113887658477427",
"294596071254082866006166602199868927138",
"44123097273450812300930639781937910857",
"323575208907687991298068880098117825539",
"238797186738342034853683495879612014117",
"251508621000385400944031961387303249575",
"203720747607038360198997327604150795125",
"129469875299155862790994639508268278458",
"1741408931555070296776883988762792989",
"104269472406583667661610471632824709086",
"5666662756678726246385970583580170979",
"234633874245789766666235084116380491598",
"154065911727362118337857682525967019647",
"173642921140429589294758366889340231475",
"330070810614922292330936088109936139809",
"322496289667194905307270753035278250606",
"339576479347264022451433844291324436468",
"307415991747331890308112501387377554999",
"331960769553118902504774005548446298115",
"103518613928960336428029911682559896538",
"111383409649779339965015561289473776397",
"263411053717820038232096070552643990893",
"200509525874240984242763393748062013994",
"41952820148020688161494400387331579268",
"152803170794301815009493856382764984922"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/netfilter/ipvs/ip_vs_xmit.c"
},
"signature_type": "Line",
"id": "CVE-2025-37961-fd15a27f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0160ac84fb03a0bd8dce8a42cb25bfaeedd110f4",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37961.json"
[
{
"digest": {
"line_hashes": [
"193202582549406671357523546287594426912",
"308061681628415176454954581988388603346",
"50997702189751900405986471035492754213",
"190471190191187935953963912314435077983"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "src/main/java/net/snowflake/client/jdbc/SnowflakeDriver.java"
},
"signature_type": "Line",
"id": "CVE-2025-37961-3095f19e",
"source": "https://github.com/snowflakedb/snowflake-jdbc/commit/c875f5a3a0c8d061650062236b7ae502c88a7da3",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"99110595428558941733660536235974439170",
"140470001048174530830414293698347823159",
"203835448806065936217955624005203900032",
"299575678048353578250356673395823974012"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "src/main/java/net/snowflake/client/jdbc/SnowflakeDriver.java"
},
"signature_type": "Line",
"id": "CVE-2025-37961-8bf83e09",
"source": "https://github.com/snowflakedb/snowflake-jdbc/commit/cc073f8917b91dd0855985c3085b99c73fe066d5",
"deprecated": false
}
]