CVE-2025-38181: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38181 is a NULL pointer dereference vulnerability in the Linux kernel's CALIPSO (Common Architecture for Next Generation Internet Protocol Security) option handling, specifically in the calipso_req_setattr() and calipso_req_delattr() functions. The flaw was disclosed on July 4, 2025, and affects Linux kernel versions from 4.8 up to (but not including) 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, and 6.15.4, as well as Debian Linux 11.0. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only low-privileged local access with no user interaction (Red Hat CVE, Feedly).

The root cause is a NULL pointer dereference (CWE-476) introduced by commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), which allowed reqsk->rsk_listener to be NULL when a SYN Cookie is returned to a client. In calipso_req_setattr(), the code calls sk_to_full_sk() on the request socket to obtain a struct sock pointer, which can be NULL in the SYN Cookie path; this NULL pointer is subsequently passed to sock_omalloc(), triggering a general protection fault (kernel oops). The fix returns an error from both calipso_req_setattr() and calipso_req_delattr() when the listener is NULL (i.e., in the SYN Cookie case), effectively disabling CALIPSO option processing for SYN Cookie connections rather than crashing the kernel (Red Hat CVE, Kernel Patch).

Successful exploitation allows a local, low-privileged user to trigger a kernel NULL pointer dereference, resulting in a kernel panic or system crash — a denial of service (DoS) condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The crash can affect all processes running on the system, making it a significant stability risk for multi-tenant or shared Linux environments using CALIPSO-enabled networking under SYN flood conditions (Red Hat CVE).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability has an EPSS score of approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The bug can be reproduced by triggering SYN Cookie processing on a CALIPSO-enabled system (e.g., using a tool to flood a listening port), as noted in the kernel commit description. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Feedly).

• Logs: Kernel log entries containing TCP: request_sock_TCPv6: Possible SYN flooding on port [...]: Sending cookies. followed immediately by Oops: general protection fault or null-ptr-deref in sock_omalloc() or calipso_req_setattr().
• Logs: Kernel oops traces referencing calipso_req_setattr or calipso_req_delattr in the call stack within /var/log/kern.log or dmesg output.
• System Behavior: Unexpected system reboots or kernel panics on hosts with CALIPSO/IPv6 security labeling enabled, particularly during periods of high SYN traffic or SYN flood events.

Apply the upstream kernel patches available for the following fixed versions: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, and 6.15.4. Distribution-specific updates have been released by Red Hat, SUSE, Ubuntu (USN-7774-1, USN-7775-1, USN-7833-1, USN-7856-1), Debian (DSA-5973-1, DLA-4328-1), Amazon Linux 2, and openSUSE. As a temporary workaround for systems that cannot be immediately patched, consider limiting network exposure of CALIPSO-enabled services and implementing network-level SYN flood protection (e.g., SYN cookies at the firewall/load balancer level to reduce kernel-level SYN Cookie processing) (Red Hat CVE, Kernel Patch, Ubuntu USN-7774-1).

Red Hat has assessed the vulnerability and published a CVE advisory, rating it as Medium severity. Multiple Linux distributions including SUSE, Ubuntu, Debian, Amazon Linux, and openSUSE have issued security advisories and kernel update packages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard distribution security channels (Red Hat CVE).