Riskcovery

CVE-2025-39673

ppp: fix race conditions in ppp_fill_forward_path

State
Published
Severity
9.8 Critical
Published
Sep 5, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix race conditions in ppp_fill_forward_path

ppp_fill_forward_path() has two race conditions:

1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic.

2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels.

Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7Affected
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before 0f1630be6fcca3f0c63e4b242ad202e5cde28a40Affected
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before ca18d751bcc9faf5b7e82e9fae1223d103928181Affected
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before 94731cc551e29511d85aa8dec61a6c071b1f2430Affected
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before f97f6475fdcb3c28ff3c55cc4b7bde632119ec08Affected
  • f6efc675c9dd8d93f826b79ae7e33e03301db609 to before 0417adf367a0af11adf7ace849af4638cfb573f7Affected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.190 through 5.15.*Not affected
  • 6.1.149 through 6.1.*Not affected
  • 6.6.103 through 6.6.*Not affected
  • 6.12.44 through 6.12.*Not affected
  • 6.16.4 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.