CVE-2025-21639

sctp: sysctl: rto_min/max: avoid using current->nsproxy

MEDIUM
5.5
CVSS Score
Published: January 19, 2025 at 10:17 AM UTC
Updated: October 15, 2026 at 01:02 AM UTC
2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.13 ≤ v < 5.10.2343.13 ≤ v < 5.15.1773.13 ≤ v < 5.4.2903.13 ≤ v < 6.1.1253.13 ≤ v < 6.12.103.13 ≤ v < 6.133.13 ≤ v < 6.6.726.2 ≤ v < 6.6.726.7 ≤ v < 6.12.104f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b56.13 rc16.13 rc26.13 rc36.13 rc46.13 rc56.13 rc6
Vendor states this is fixed in 0f78f09466744589e420935e646ae78212a38290 (fixed)
Vendor states this is fixed in 246428bfb9e7db15c5cd08e1d0eca41b65af2b06 (fixed)
Vendor states this is fixed in 4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482 (fixed)
Vendor states this is fixed in 9fc17b76fc70763780aa78b38fcf4742384044a5 (fixed)
Vendor states this is fixed in c87f1f6ade56c711f8736901e330685b453e420e (fixed)
Vendor states this is fixed in c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9 (fixed)
Vendor states this is fixed in dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f (fixed)
Vendor states this is fixed in 3.13 (unaffected)
Vendor states this is fixed in 5.10.234 (unaffected)
Vendor states this is fixed in 5.15.177 (unaffected)
Vendor states this is fixed in 5.4.290 (unaffected)
Vendor states this is fixed in 6.1.125 (unaffected)
Vendor states this is fixed in 6.12.10 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)
Vendor states this is fixed in 6.6.72 (unaffected)

References (10)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0f78f09466744589e420935e646ae78212a38290
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/246428bfb9e7db15c5cd08e1d0eca41b65af2b06
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9fc17b76fc70763780aa78b38fcf4742384044a5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c87f1f6ade56c711f8736901e330685b453e420e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card