Executive brief
A vulnerability in the Linux kernel's implementation of the SCTP networking protocol could allow a remote attacker to crash the system. SCTP is a protocol used for transporting data over networks, often in telecommunications or specialized data environments. An exploit could lead to a denial-of-service condition, impacting the availability of services running on the affected server.
Technical details
A null pointer dereference exists in the net/sctp/sm_statefuns.c component of the Linux kernel, specifically within the sctp_sf_do_5_1D_ce() function. The vulnerability occurs when certain conditions are met during SCTP association processing: if new_asoc->peer.adaptation_ind is zero and sctp_ulpevent_make_authkey() returns zero, the variable ai_ev remains uninitialized (zero). This zero value is subsequently passed to sctp_ulpevent_free(), resulting in a null pointer dereference. A remote attacker can trigger this by sending specially crafted SCTP packets, leading to a kernel panic (Denial of Service). The issue has been resolved by adding a null check before calling the free function.
Affected products
- Linux Linux Kernel 4.17 to 6.11.x
Timeline
- 2025-10-02: disclosed: Initial patch submitted by Alexandr Sapozhnikov
- 2025-10-06: patched: Patch committed to mainline kernel
- 2025-11-12: advisory: CVE-2025-40187 published
References
- https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447
- https://git.kernel.org/stable/c/1014b83778c8677f1d7a57c26dc728baa801ac62
- https://git.kernel.org/stable/c/2f3119686ef50319490ccaec81a575973da98815
- https://git.kernel.org/stable/c/7f702f85df0266ed7b5bab81ba50394c92f3c928
- https://git.kernel.org/stable/c/badbd79313e6591616c1b78e29a9b71efed7f035
- https://git.kernel.org/stable/c/c21f45cfa4a9526b34d76b397c9ef080668b6e73
- https://git.kernel.org/stable/c/d0e8f1445c19b1786759ba72a38267e1449bab7e