CVE-2025-22057

In the Linux kernel, the following vulnerability has been resolved:

net: decrease cached dst counters in dst_release

Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts:

Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30

Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too.

This vulnerability is rated as Moderate severity because exploitation requires local access and specific networking configurations, with the resulting impact confined to a denial of service. Under typical Red Hat Enterprise Linux deployments, triggering this invalid memory access requires dismantling a network namespace configured with Open vSwitch tunneling. Because an attacker cannot leverage this issue for arbitrary code execution or data exfiltration, the overall blast radius is limited to host availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.