APPLIED: [SRU][J][PATCH 0/1] CVE-2025-22057

[Stefan Bader]

On 09/09/2026 20:59, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-22057
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> net: decrease cached dst counters in dst_release
> 
> Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in
> dst_release()") moved decrementing the dst count from dst_destroy to
> dst_release to avoid accessing already freed data in case of netns dismantle.
> However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix
> is incomplete as the same issue will be seen for cached dsts:
> 
> Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call
> trace: percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108
> dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0
> rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30
> 
> Fix this by invalidating the cache, and thus decrementing cached dst counters,
> in dst_release too.
> 
> [ Fix ]
> 
> jammy/linux: backported from 3a0a3ff6593d
> 
> This tree predates the rcuref_put/call_rcu_hurry rewrite of dst_release, so
> the CONFIG_DST_CACHE reset block was inserted into the older
> atomic_dec_return-based dst_release, inside the `if (!newrefcnt)` branch that
> uses call_rcu. This mirrors the upstream change of invalidating the dst cache
> during release rather than during destroy, so the cached dst counters are
> decremented before the referenced data can be freed.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> The change touches the generic dst_release() path, which is exercised by all
> network traffic, so a regression could in principle affect any networking
> workload. In practice the modified code only runs when CONFIG_DST_CACHE is
> enabled and a dst cache is attached to the entry being released, which is the
> case for Open vSwitch and tunnel (for example VXLAN) setups; systems running
> OvS with tunnels are the most likely to surface any problem. A faulty fix
> could manifest as incorrect dst reference or counter accounting, leading to
> leaked or prematurely freed dst entries. Plain hosts that do not use OvS or
> tunnels, or kernels built without CONFIG_DST_CACHE, are not affected by the
> new code path.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: 64c61674/v1
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/42d114bd/attachment-0001.sig>