Junglewise Threat Intelligence

CVE-2025-21640: Linux Kernel NULL pointer dereference in SCTP sysctl

CVE-2025-21640 · Severity: medium · CVSS 5.5 · Published 2025-01-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system attempts to access network configuration data while a process is exiting, leading to a 'kernel oops' or system crash. This impacts the availability of the server but does not directly expose customer data.

Technical details

A NULL pointer dereference (CWE-476) exists in net/sctp/sysctl.c within the proc_sctp_do_hmac_alg function. The vulnerability is caused by the code incorrectly using 'current->nsproxy' to access the network namespace ('net') structure. In certain race conditions, such as when a task is exiting (e.g., during an acct(2) syscall), 'current->nsproxy' can be NULL, leading to a kernel panic. The fix involves obtaining the 'net' structure via 'container_of()' from the 'table->data' pointer instead of the 'current' task proxy. This issue was resolved in multiple stable branches including 6.1.125, 6.6.72, 6.12.10, and the 6.13-rc series.

Affected products

  • Linux Linux Kernel 3.8 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6

Timeline

  • 2025-01-08: other: Patch authored
  • 2025-01-19: advisory: CVE-2025-21640 published
  • 2025-01-23: patched: Merged into stable kernel trees

References

Related threats