CVE-2025-21638

sctp: sysctl: auth_enable: avoid using current->nsproxy

State: Published
Severity: 7.1 High
Published: Jan 19, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: sysctl: auth_enable: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).

The 'net' structure can be obtained from the table->data using container_of().

Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b14878ccb7fac0242db82720b784ab62c467c0dc to before cf387cdebfaebae228dfba162f94c567a67610c3Affected b14878ccb7fac0242db82720b784ab62c467c0dc to before dc583e7e5f8515ca489c0df28e4362a70eade382Affected b14878ccb7fac0242db82720b784ab62c467c0dc to before bd2a2939423566c654545fa3e96a656662a0af9eAffected b14878ccb7fac0242db82720b784ab62c467c0dc to before 1b67030d39f2b00f94ac1f0af11ba6657589e4d3Affected b14878ccb7fac0242db82720b784ab62c467c0dc to before 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6Affected b14878ccb7fac0242db82720b784ab62c467c0dc to before c184bc621e3cef03ac9ba81a50dda2dae6a21d36Affected b14878ccb7fac0242db82720b784ab62c467c0dc to before 15649fd5415eda664ef35780c2013adeb5d9c695Affected e5eae4a0511241959498b180fa0df0d4f1b11b9cAffected 88830f227a1f96e44d82ddfcb0cc81d517ec6dd8Affected 3938b0336a93fa5faa242dc9e5823ac69df9e066Affected 3.10.41 to before 3.11Affected 3.12.21 to before 3.13Affected 3.14.5 to before 3.15Affected
LinuxLinux	3.15Affected before 3.15Not affected 5.4.292 through 5.4.Not affected 5.10.234 through 5.10.Not affected 5.15.177 through 5.15.Not affected 6.1.125 through 6.1.Not affected 6.6.72 through 6.6.Not affected 6.12.10 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

b14878ccb7fac0242db82720b784ab62c467c0dc to before cf387cdebfaebae228dfba162f94c567a67610c3Affected
b14878ccb7fac0242db82720b784ab62c467c0dc to before dc583e7e5f8515ca489c0df28e4362a70eade382Affected
b14878ccb7fac0242db82720b784ab62c467c0dc to before bd2a2939423566c654545fa3e96a656662a0af9eAffected
b14878ccb7fac0242db82720b784ab62c467c0dc to before 1b67030d39f2b00f94ac1f0af11ba6657589e4d3Affected
b14878ccb7fac0242db82720b784ab62c467c0dc to before 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6Affected
b14878ccb7fac0242db82720b784ab62c467c0dc to before c184bc621e3cef03ac9ba81a50dda2dae6a21d36Affected
b14878ccb7fac0242db82720b784ab62c467c0dc to before 15649fd5415eda664ef35780c2013adeb5d9c695Affected
e5eae4a0511241959498b180fa0df0d4f1b11b9cAffected
88830f227a1f96e44d82ddfcb0cc81d517ec6dd8Affected
3938b0336a93fa5faa242dc9e5823ac69df9e066Affected
3.10.41 to before 3.11Affected
3.12.21 to before 3.13Affected
3.14.5 to before 3.15Affected

LinuxLinux

3.15Affected
before 3.15Not affected
5.4.292 through 5.4.*Not affected
5.10.234 through 5.10.*Not affected
5.15.177 through 5.15.*Not affected
6.1.125 through 6.1.*Not affected
6.6.72 through 6.6.*Not affected
6.12.10 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.