CVE-2025-21640

sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy

State
Published
Severity
7.1 High
Published
Jan 19, 2025
Updated
Oct 15, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).

The 'net' structure can be obtained from the table->data using container_of().

Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3c68198e75111a905ac2412be12bf7b29099729b to before 5599b212d2f4466e1832a94e9932684aaa364587Affected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before 03ca51faba2b017bf6c90e139434c4117d0afcdcAffected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before 86ddf8118123cb58a0fb8724cad6979c4069065bAffected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before 3cd0659deb9c03535fd61839e91d4d4d3e51ac71Affected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before ad673e514b2793b8d5902f6ba6ab7e890dea23d5Affected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before f0bb3935470684306e4e04793a20ac4c4b08de0bAffected
  • 3c68198e75111a905ac2412be12bf7b29099729b to before ea62dd1383913b5999f3d16ae99d411f41b528d4Affected
LinuxLinux
  • 3.8Affected
  • before 3.8Not affected
  • 5.4.292 through 5.4.*Not affected
  • 5.10.234 through 5.10.*Not affected
  • 5.15.177 through 5.15.*Not affected
  • 6.1.125 through 6.1.*Not affected
  • 6.6.72 through 6.6.*Not affected
  • 6.12.10 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.