Is CVE-2025-39673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-39673 being exploited in the wild.

How severe is CVE-2025-39673?

Critical severity, with a CVSS score of 9.8, published 5 September 2025.

Which products and versions are affected?

Linux Kernel 5.13 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4, 5.13 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.

Is there a fix for CVE-2025-39673?

A patch was published on 2025-08-14: Initial patch submitted by Qingfang Deng Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-39673 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-39673?

Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-39673: Linux Kernel race condition in ppp_fill_forward_path

CVE-2025-39673 · Severity: critical · CVSS 9.8 · Published 2025-09-05

A vulnerability exists in the Linux kernel's Point-to-Point Protocol (PPP) implementation, which is used for establishing network connections. Due to a flaw in how the system handles internal data lists, a race condition can occur that leads to a system crash (kernel panic). This could allow an attacker to disrupt network services or potentially gain unauthorized access to the system.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-39673 being exploited in the wild.
How severe is CVE-2025-39673?: Critical severity, with a CVSS score of 9.8, published 5 September 2025.
Which products and versions are affected?: Linux Kernel 5.13 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4, 5.13 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.
Is there a fix for CVE-2025-39673?: A patch was published on 2025-08-14: Initial patch submitted by Qingfang Deng Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39673 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-39673?: Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in the ppp_fill_forward_path() function within the Linux kernel's PPP implementation (drivers/net/ppp/ppp_generic.c). The vulnerability arises because the ppp->channels list can be modified between a list_empty() check and a list_first_entry() call without holding the ppp_lock, potentially leading to access of a freed entry. Additionally, pch->chan can be set to NULL during unregistration before the channel is removed from the list, leading to a NULL pointer dereference. Attackers can exploit this to trigger a kernel panic. The fix involves implementing a lockless RCU approach using list_first_or_null_rcu(), RCU list modification variants, and proper NULL checks for pch->chan.

Affected products

Linux Linux Kernel 5.13 to 6.16.4
Siemens SIMATIC CN 4100 before V5.0

Timeline

2025-08-14: patched: Initial patch submitted by Qingfang Deng
2025-09-05: disclosed: CVE-2025-39673 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.