{"id":"CVE-2025-40187","state":"PUBLISHED","title":"net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()\n\nIf new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0\nand sctp_ulpevent_make_authkey() returns 0, then the variable\nai_ev remains zero and the zero will be dereferenced\nin the sctp_ulpevent_free() function.","publishedAt":"2025-11-12T21:56:29.504Z","updatedAt":"2026-10-15T22:02:40.120Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"1014b83778c8677f1d7a57c26dc728baa801ac62","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"7f702f85df0266ed7b5bab81ba50394c92f3c928","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"dbceedc0213e75bf3e9f9f9e2f66b10699d004fe","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"025419f4e216a3ae0d0cec622262e98e8078c447","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"c21f45cfa4a9526b34d76b397c9ef080668b6e73","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"d0e8f1445c19b1786759ba72a38267e1449bab7e","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"badbd79313e6591616c1b78e29a9b71efed7f035","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"2f3119686ef50319490ccaec81a575973da98815","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.17","versionType":"semver"},{"version":"5.4.301","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.246","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.195","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.157","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.113","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.54","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.4","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]}],"references":["https://git.kernel.org/stable/c/1014b83778c8677f1d7a57c26dc728baa801ac62","https://git.kernel.org/stable/c/7f702f85df0266ed7b5bab81ba50394c92f3c928","https://git.kernel.org/stable/c/dbceedc0213e75bf3e9f9f9e2f66b10699d004fe","https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447","https://git.kernel.org/stable/c/c21f45cfa4a9526b34d76b397c9ef080668b6e73","https://git.kernel.org/stable/c/d0e8f1445c19b1786759ba72a38267e1449bab7e","https://git.kernel.org/stable/c/badbd79313e6591616c1b78e29a9b71efed7f035","https://git.kernel.org/stable/c/2f3119686ef50319490ccaec81a575973da98815"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40187.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40187","state":"PUBLISHED","datePublished":"2025-11-12T21:56:29.504Z","dateUpdated":"2026-10-15T22:02:40.120Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.177Z"},"containers":{"cna":{"title":"net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()\n\nIf new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0\nand sctp_ulpevent_make_authkey() returns 0, then the variable\nai_ev remains zero and the zero will be dereferenced\nin the sctp_ulpevent_free() function."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"1014b83778c8677f1d7a57c26dc728baa801ac62","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"7f702f85df0266ed7b5bab81ba50394c92f3c928","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"dbceedc0213e75bf3e9f9f9e2f66b10699d004fe","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"025419f4e216a3ae0d0cec622262e98e8078c447","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"c21f45cfa4a9526b34d76b397c9ef080668b6e73","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"d0e8f1445c19b1786759ba72a38267e1449bab7e","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"badbd79313e6591616c1b78e29a9b71efed7f035","versionType":"git"},{"version":"30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b","status":"affected","lessThan":"2f3119686ef50319490ccaec81a575973da98815","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.17","versionType":"semver"},{"version":"5.4.301","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.246","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.195","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.157","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.113","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.54","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.4","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_statefuns.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1014b83778c8677f1d7a57c26dc728baa801ac62"},{"url":"https://git.kernel.org/stable/c/7f702f85df0266ed7b5bab81ba50394c92f3c928"},{"url":"https://git.kernel.org/stable/c/dbceedc0213e75bf3e9f9f9e2f66b10699d004fe"},{"url":"https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447"},{"url":"https://git.kernel.org/stable/c/c21f45cfa4a9526b34d76b397c9ef080668b6e73"},{"url":"https://git.kernel.org/stable/c/d0e8f1445c19b1786759ba72a38267e1449bab7e"},{"url":"https://git.kernel.org/stable/c/badbd79313e6591616c1b78e29a9b71efed7f035"},{"url":"https://git.kernel.org/stable/c/2f3119686ef50319490ccaec81a575973da98815"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the SCTP state machine's COOKIE ECHO handler, driven entirely by chunks received from a remote peer over IP, and is reached from `sctp_rcv()` in NET_RX softirq context. Any host with a listening SCTP socket (telecom SIGTRAN/M3UA/Diameter signalling nodes are routinely inter-carrier and internet facing) is remotely reachable.\nAC:L - The attacker deterministically controls both selectable preconditions by simply omitting the Adaptation Layer Indication parameter (leaving `ai_ev` NULL) and omitting the SCTP-AUTH parameters (forcing the `sctp_ulpevent_make_authkey()` call), which are the default characteristics of a plain handshake. The only remaining factor is the GFP_ATOMIC allocation failing, which the attacker can influence by flooding the target with concurrent association attempts and traffic to exhaust atomic reserves — particularly effective on the memory-constrained embedded/telecom devices where SCTP is deployed.\nPR:N - SCTP association establishment is entirely unauthenticated; the attacker only needs to complete the standard INIT / INIT-ACK / COOKIE ECHO exchange against a listening socket, with the state cookie having been minted by the victim itself. No credentials, capabilities, or local account are involved anywhere along the path.\nUI:N - Exploitation requires nothing from any local user or administrator beyond the pre-existing condition that an SCTP service is listening. The attacker drives the entire handshake unilaterally.\nS:U - The NULL dereference faults inside the kernel handling the same network stack that received the packet; there is no crossing into another security authority such as a hypervisor, IOMMU, or sandbox boundary.\nC:N - The dereference is a read of `event->msg_flags` at a fixed low offset from NULL, which faults immediately; no data is returned to the attacker and no kernel memory contents are disclosed.\nI:N - The bug is a read fault on a NULL pointer with no write, no out-of-bounds access, and no object lifetime confusion, so no kernel data is modified and no control-flow hijack primitive is produced.\nA:H - The dereference occurs in NET_RX softirq context, producing a fatal exception in interrupt — a kernel panic and complete loss of availability, or at minimum an oops that kills the softirq path (and an immediate panic on the `panic_on_oops` configurations common in embedded and telecom deployments). The attacker can repeat the attempt indefinitely across reboots."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:08:25.629Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.4.301"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.10.246"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.15.195"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.1.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.6.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.12.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.17.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-40187","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T21:57:50.354384Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:40.120Z"}}]}}}