CVE-2025-37749

net: ppp: Add bound checking for skb data on ppp_sync_txmung

State: Published
Severity: 8.2 High
Published: May 1, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ppp: Add bound checking for skb data on ppp_sync_txmung

Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets.

When ppp_sync_txmung receives an incoming package with an empty payload: (remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 }

from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, data_len = 0x0, mac_len = 0xe, hdr_len = 0x0,

it is not safe to access data[2].

[pabeni@redhat.com: fixed subj typo]

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 529401c8f12ecc35f9ea5d946d5a5596cf172b48Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before de5a4f0cba58625e88b7bebd88f780c8c0150997Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 99aa698dec342a07125d733e39aab4394b3b7e05Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b78f2b458f56a5a4d976c8e01c43dbf58d3ea2caAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b4c836d33ca888695b2f2665f948bc1b34fbd533Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f6eb9fa87a781d5370c0de7794ae242f1a95ee5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e8a6bf43cea4347121ab21bb1ed8d7bef7e732eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before aabc6596ffb377c4c9c8f335124b92ea282c9821Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.293 through 5.4.Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.135 through 6.1.Not affected 6.6.88 through 6.6.Not affected 6.12.24 through 6.12.Not affected 6.13.12 through 6.13.Not affected 6.14.3 through 6.14.Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 529401c8f12ecc35f9ea5d946d5a5596cf172b48Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before de5a4f0cba58625e88b7bebd88f780c8c0150997Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 99aa698dec342a07125d733e39aab4394b3b7e05Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b78f2b458f56a5a4d976c8e01c43dbf58d3ea2caAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b4c836d33ca888695b2f2665f948bc1b34fbd533Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f6eb9fa87a781d5370c0de7794ae242f1a95ee5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e8a6bf43cea4347121ab21bb1ed8d7bef7e732eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before aabc6596ffb377c4c9c8f335124b92ea282c9821Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.293 through 5.4.*Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.135 through 6.1.*Not affected
6.6.88 through 6.6.*Not affected
6.12.24 through 6.12.*Not affected
6.13.12 through 6.13.*Not affected
6.14.3 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.