CVE-2025-68813

A NULL pointer dereference vulnerability was found in the Linux kernel's IPVS (IP Virtual Server) implementation. In __ip_vs_get_out_rt(), when route lookup fails, dst_link_failure() is called with skb->dev set to NULL. The subsequent call chain through ipv4_link_failure() to fib_compute_spec_dst() dereferences skb->dev, causing a kernel crash when IPVS processes packets in NAT mode with a misconfigured destination.

This vulnerability affects systems using IPVS for load balancing with NAT mode. The crash occurs when route lookup fails before establishing a route, typically due to misconfiguration. The issue was discovered by KASAN and syzkaller. Prior partial fixes addressed some NULL dereferences but not all code paths.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip_vs module from being loaded if IPVS load balancing functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.