CVE-2025-38184

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

The reproduction steps:

1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun

tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer eth:syz_tun ↗, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0

the ub was in fact a struct dev.

when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it.

fix this by checking media_id.

This vulnerability is rated as Moderate because exploitation requires local privileges to send specific TIPC netlink requests, and the resulting impact is limited to a system crash (denial of service) without allowing privilege escalation or data disclosure. The Transparent Inter-Process Communication (TIPC) kernel module is not loaded by default on Red Hat Enterprise Linux. Systems that do not explicitly configure or run TIPC are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.