Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-40240

sctp: avoid NULL dereference when chunk data buffer is missing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 61cda2777b07d27459f5cac5a047c3edf9c8a1a9affected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 08165c296597075763130919f2aae59b5822f016affected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 03e80a4b04ef1fb2c61dd63216ab8d3a5dcb196faffected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 4f6da435fb5d8a21cbf8cae5ca5a2ba0e1012b71affected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < cb9055ba30306ede4ad920002233d0659982f1cbaffected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 7a832b0f99be19df608cb75c023f8027b1789bd1affected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 89b465b54227c245ddc7cc9ed822231af21123efaffected
  • 90017accff61ae89283ad9a51f9ac46ca01633fb to < 441f0647f7673e0e64d4910ef61a5fb8f16bfb82affected

Linux Linux

Default version status: affected

  • 4.8affected
  • 0 to < 4.8unaffected
  • 5.4.301 to ≤ 5.4.*unaffected
  • 5.10.246 to ≤ 5.10.*unaffected
  • 5.15.196 to ≤ 5.15.*unaffected
  • 6.1.158 to ≤ 6.1.*unaffected
  • 6.6.115 to ≤ 6.6.*unaffected
  • 6.12.56 to ≤ 6.12.*unaffected
  • 6.17.6 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References