CVE-2025-39848

ax25: properly unshare skbs in ax25_kiss_rcv()

State: Published
Severity: 8.8 High
Published: Sep 19, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ax25: properly unshare skbs in ax25_kiss_rcv()

Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 42b46684e2c78ee052d8c2ee8d9c2089233c9094Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5b079be1b9da49ad88fc304c874d4be7085f7883Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2bd0f67212908243ce88e35bf69fa77155b47b14Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 01a2984cb803f2d487b7074f9718db2bf3531f69Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d449b7a6c8ee434d10a483feed7c5c50108cf56Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89064cf534bea4bb28c83fe6bbb26657b19dd5feAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b1c71d674a308d2fbc83efcf88bfc4217a86aa17Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8156210d36a43e76372312c87eb5ea3dbb405a85Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.299 through 5.4.Not affected 5.10.243 through 5.10.Not affected 5.15.192 through 5.15.Not affected 6.1.151 through 6.1.Not affected 6.6.105 through 6.6.Not affected 6.12.46 through 6.12.Not affected 6.16.6 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 42b46684e2c78ee052d8c2ee8d9c2089233c9094Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5b079be1b9da49ad88fc304c874d4be7085f7883Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2bd0f67212908243ce88e35bf69fa77155b47b14Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 01a2984cb803f2d487b7074f9718db2bf3531f69Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d449b7a6c8ee434d10a483feed7c5c50108cf56Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89064cf534bea4bb28c83fe6bbb26657b19dd5feAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b1c71d674a308d2fbc83efcf88bfc4217a86aa17Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8156210d36a43e76372312c87eb5ea3dbb405a85Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.299 through 5.4.*Not affected
5.10.243 through 5.10.*Not affected
5.15.192 through 5.15.*Not affected
6.1.151 through 6.1.*Not affected
6.6.105 through 6.6.*Not affected
6.12.46 through 6.12.*Not affected
6.16.6 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.