Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2025-21638

sctp: sysctl: auth_enable: avoid using current->nsproxy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b14878ccb7fac0242db82720b784ab62c467c0dc to < cf387cdebfaebae228dfba162f94c567a67610c3affected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < dc583e7e5f8515ca489c0df28e4362a70eade382affected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < bd2a2939423566c654545fa3e96a656662a0af9eaffected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < 1b67030d39f2b00f94ac1f0af11ba6657589e4d3affected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6affected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < c184bc621e3cef03ac9ba81a50dda2dae6a21d36affected
  • b14878ccb7fac0242db82720b784ab62c467c0dc to < 15649fd5415eda664ef35780c2013adeb5d9c695affected
  • e5eae4a0511241959498b180fa0df0d4f1b11b9caffected
  • 88830f227a1f96e44d82ddfcb0cc81d517ec6dd8affected
  • 3938b0336a93fa5faa242dc9e5823ac69df9e066affected
  • 3.10.41 to < 3.11affected
  • 3.12.21 to < 3.13affected
  • 3.14.5 to < 3.15affected

Linux Linux

Default version status: affected

  • 3.15affected
  • 0 to < 3.15unaffected
  • 5.4.292 to ≤ 5.4.*unaffected
  • 5.10.234 to ≤ 5.10.*unaffected
  • 5.15.177 to ≤ 5.15.*unaffected
  • 6.1.125 to ≤ 6.1.*unaffected
  • 6.6.72 to ≤ 6.6.*unaffected
  • 6.12.10 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References