Executive brief
A vulnerability was identified in the Linux kernel's implementation of the SCTP networking protocol, which is used for transporting data over networks. An attacker could exploit this flaw to cause a system crash or instability by sending specially crafted network traffic. This primarily impacts the availability of the affected system, potentially leading to a denial-of-service condition.
Technical details
A NULL pointer dereference vulnerability exists in net/sctp/inqueue.c within the Linux kernel's SCTP implementation. The flaw occurs because the 'chunk->skb' pointer is dereferenced in a code block where it was incorrectly assumed to be non-NULL, specifically when handling GSO (Generic Segmentation Offload) enabled chunks where data might be missing from the expected buffer. An unauthenticated remote attacker can trigger this by sending malformed SCTP packets, leading to a kernel panic. The fix involves validating the 'frag_list' before attempting to replace the 'chunk->skb' pointer. Patches have been released for multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, and 6.1.y.
Affected products
- Linux Linux Kernel 4.8 to 6.1.158, 5.4.301, 5.10.246, 5.15.196
Timeline
- 2025-10-21: disclosed: Initial patch submission by Alexey Simakov
- 2025-10-29: patched: Commits merged into stable kernel trees
- 2025-12-04: advisory: CVE published
References
- https://git.kernel.org/stable/c/03e80a4b04ef1fb2c61dd63216ab8d3a5dcb196f
- https://git.kernel.org/stable/c/08165c296597075763130919f2aae59b5822f016
- https://git.kernel.org/stable/c/441f0647f7673e0e64d4910ef61a5fb8f16bfb82
- https://git.kernel.org/stable/c/4f6da435fb5d8a21cbf8cae5ca5a2ba0e1012b71
- https://git.kernel.org/stable/c/61cda2777b07d27459f5cac5a047c3edf9c8a1a9
- https://git.kernel.org/stable/c/7a832b0f99be19df608cb75c023f8027b1789bd1
- https://git.kernel.org/stable/c/89b465b54227c245ddc7cc9ed822231af21123ef