CVE-2025-21636

sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy

State
Published
Severity
5.5 Medium
Published
Jan 19, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).

The 'net' structure can be obtained from the table->data using container_of().

Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.probe_interval' is used.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • d1e462a7a5f359cbb9a0e8fbfafcfb6657034105 to before 1dc5da6c4178f3e4b95c631418f72de9f86c0449Affected
  • d1e462a7a5f359cbb9a0e8fbfafcfb6657034105 to before 44ee8635922b6eb940faddb961a8347c6857d722Affected
  • d1e462a7a5f359cbb9a0e8fbfafcfb6657034105 to before 284a221f8fa503628432c7bb5108277c688c6ffaAffected
  • d1e462a7a5f359cbb9a0e8fbfafcfb6657034105 to before bcf8c60074e81ed2ac2d35130917175a3949c917Affected
  • d1e462a7a5f359cbb9a0e8fbfafcfb6657034105 to before 6259d2484d0ceff42245d1f09cc8cb6ee72d847aAffected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.177 through 5.15.*Not affected
  • 6.1.125 through 6.1.*Not affected
  • 6.6.72 through 6.6.*Not affected
  • 6.12.10 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.