CVE-2025-68813: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68813 is a NULL pointer dereference vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem, specifically in the IPv4 code path of __ip_vs_get_out_rt(). When IPVS processes a packet in NAT mode with a misconfigured destination and a route lookup fails, the error path calls dst_link_failure(skb) with skb->dev == NULL, ultimately causing a kernel crash via fib_compute_spec_dst(). The vulnerability affects multiple Linux kernel versions across major distributions including Debian, Ubuntu, SUSE, Red Hat, Oracle, and Amazon Linux. It was published on January 13, 2026, and has an EPSS score of 0.018% (Feedly, CVE.org).

The root cause is a NULL pointer dereference (CWE-476) in the IPVS IPv4 routing error path. The issue stems from an incomplete fix in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), which addressed the immediate dev_net(skb->dev) dereference using a fallback device but failed to account for fib_compute_spec_dst() later in the call chain — introduced by commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") — which directly dereferences skb->dev. The crash sequence is: IPVS NAT mode packet → route lookup failure in __ip_vs_get_out_rt() → dst_link_failure(skb) with skb->dev == NULL → ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() → NULL dereference. The fix involves ensuring skb->dev is set before calling dst_link_failure() in the IPVS error path (Feedly, CVE.org).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and complete denial of service of the affected host. The vulnerability affects availability only — there is no direct confidentiality or integrity impact. Systems running IPVS in NAT mode with misconfigured or unreachable destinations are at risk, which may include load balancers and network appliances built on Linux (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in fib_compute_spec_dst, __ip_options_compile, ipv4_link_failure, or __ip_vs_get_out_rt.
• System Behavior: Unexpected system reboots or kernel panics on hosts running IPVS in NAT mode, particularly when backend destinations are unreachable or misconfigured.

Patches have been applied to multiple stable Linux kernel branches via commits to the kernel stable tree (e.g., commits 25ab24df31f7, 312d7cd88882, 689a627d1478, 4729ff058, ad891bb3d079). Downstream distributions have issued security advisories and updated packages: Debian (DSA-6126-1, DLA-4475-1 for kernel 6.1.162-1 and 5.10.249-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE (multiple advisories including SUSE-2026-0350, SUSE-2026-0447, SUSE-2026-0943, SUSE-2026-0992, SUSE-2026-1048, SUSE-2026-1136), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), Oracle Linux 9, and Red Hat. As a workaround where patching is not immediately possible, disabling IPVS NAT mode or ensuring all IPVS destinations are reachable can reduce exposure (Feedly, Debian LTS, Ubuntu USN-8177-1).