Executive brief
A vulnerability exists in the Linux kernel's AX.25 network protocol implementation, which is used for amateur radio communications. An attacker on the same local network could send specially crafted data packets to cause a system crash or potentially corrupt memory. This could lead to a complete loss of system availability or unauthorized access to sensitive information.
Technical details
A vulnerability exists in the ax25_kiss_rcv() function within the Linux kernel's AX.25 network stack. The root cause is a failure to properly unshare socket buffers (skbs) before they are queued or mangled. When a shared skb is modified, it can lead to a NULL pointer dereference in __netif_receive_skb_core() or other memory corruption. An attacker within the same adjacent network (Layer 2) can exploit this to cause a Denial of Service (kernel panic) or potentially achieve remote code execution. The issue has been addressed by adding an skb_share_check() call in the affected receive path.
Affected products
- Linux Linux Kernel 2.6.12 through 6.11.y
- Siemens SIMATIC CN 4100 before V5.0
Timeline
- 2025-09-02: patched: Initial patch authored by Eric Dumazet
- 2025-09-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/01a2984cb803f2d487b7074f9718db2bf3531f69
- https://git.kernel.org/stable/c/2bd0f67212908243ce88e35bf69fa77155b47b14
- https://git.kernel.org/stable/c/42b46684e2c78ee052d8c2ee8d9c2089233c9094
- https://git.kernel.org/stable/c/5b079be1b9da49ad88fc304c874d4be7085f7883
- https://git.kernel.org/stable/c/7d449b7a6c8ee434d10a483feed7c5c50108cf56
- https://git.kernel.org/stable/c/8156210d36a43e76372312c87eb5ea3dbb405a85
- https://git.kernel.org/stable/c/89064cf534bea4bb28c83fe6bbb26657b19dd5fe