Executive brief
A vulnerability was identified in the Linux kernel's implementation of the SCTP protocol, which is used for transporting data over networks. Under certain conditions, specifically when network timing parameters are set to unusually large values, the system could experience a crash or instability. This could potentially be used by an attacker to disrupt network services or cause a denial-of-service on the affected system.
Technical details
A shift-out-of-bounds vulnerability exists in the net/sctp/transport.c component of the Linux kernel. The function sctp_transport_update_rto() performs bitwise shift operations using the rto_alpha and rto_beta parameters. If these sysctl values are configured to be 32 or greater, it results in an undefined shift operation on 32-bit unsigned integers, as reported by UBSAN. An attacker or a misconfigured system could trigger this by providing or setting large RTO values, leading to a kernel panic or unpredictable behavior. The fix introduces run-time checks to ensure the shift exponent is less than 32 and utilizes READ_ONCE() to prevent race conditions during sysctl access.
Affected products
- Linux Linux kernel All versions prior to the fix (specifically affecting SCTP module)
Timeline
- 2025-11-06: other: Patch submitted by Eric Dumazet
- 2025-12-03: patched: Patch committed to stable tree
- 2025-12-06: disclosed: CVE-2025-40281 published
References
- https://git.kernel.org/stable/c/0e0413e3315199b23ff4aec295e256034cd0a6e4
- https://git.kernel.org/stable/c/1534ff77757e44bcc4b98d0196bc5c0052fce5fa
- https://git.kernel.org/stable/c/1cfa4eac275cc4875755c1303d48a4ddfe507ca8
- https://git.kernel.org/stable/c/834e65be429c0fa4f9bb5945064bd57f18ed2187
- https://git.kernel.org/stable/c/aaba523dd7b6106526c24b1fd9b5fc35e5aaa88d
- https://git.kernel.org/stable/c/abb086b9a95d0ed3b757ee59964ba3c4e4b2fc1a
- https://git.kernel.org/stable/c/d0d858652834dcf531342c82a0428170aa7c2675