CVE-2025-21640

sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy

MEDIUM
5.5
CVSS Score
Published: January 19, 2025 at 10:17 AM UTC
Updated: October 15, 2026 at 10:18 PM UTC
2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.8 ≤ v < 6.1.1256.2 ≤ v < 6.6.726.7 ≤ v < 6.12.103c68198e75111a905ac2412be12bf7b29099729b6.136.13 rc16.13 rc26.13 rc36.13 rc46.13 rc56.13 rc6
Vendor states this is fixed in 03ca51faba2b017bf6c90e139434c4117d0afcdc (fixed)
Vendor states this is fixed in 3cd0659deb9c03535fd61839e91d4d4d3e51ac71 (fixed)
Vendor states this is fixed in 5599b212d2f4466e1832a94e9932684aaa364587 (fixed)
Vendor states this is fixed in 86ddf8118123cb58a0fb8724cad6979c4069065b (fixed)
Vendor states this is fixed in ad673e514b2793b8d5902f6ba6ab7e890dea23d5 (fixed)
Vendor states this is fixed in ea62dd1383913b5999f3d16ae99d411f41b528d4 (fixed)
Vendor states this is fixed in f0bb3935470684306e4e04793a20ac4c4b08de0b (fixed)
Vendor states this is fixed in 3.8 (unaffected)
Vendor states this is fixed in 5.10.234 (unaffected)
Vendor states this is fixed in 5.15.177 (unaffected)
Vendor states this is fixed in 5.4.292 (unaffected)
Vendor states this is fixed in 6.1.125 (unaffected)
Vendor states this is fixed in 6.12.10 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)
Vendor states this is fixed in 6.6.72 (unaffected)

References (10)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/03ca51faba2b017bf6c90e139434c4117d0afcdc
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3cd0659deb9c03535fd61839e91d4d4d3e51ac71
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/86ddf8118123cb58a0fb8724cad6979c4069065b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ad673e514b2793b8d5902f6ba6ab7e890dea23d5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ea62dd1383913b5999f3d16ae99d411f41b528d4
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f0bb3935470684306e4e04793a20ac4c4b08de0b
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card