CVE-2025-37749

net: ppp: Add bound checking for skb data on ppp_sync_txmung

HIGH

7.1

CVSS Score

Published: May 1, 2025 at 12:55 PM UTC

Updated: August 5, 2026 at 12:44 PM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on ppp_sync_txmung Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets. When ppp_sync_txmung receives an incoming package with an empty payload: (remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 } from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, data_len = 0x0, mac_len = 0xe, hdr_len = 0x0, it is not safe to access data[2]. [[email protected]: fixed subj typo]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

2.6.12 ≤ v < 5.10.2372.6.12 ≤ v < 5.15.1812.6.12 ≤ v < 5.4.2932.6.12 ≤ v < 6.1.1352.6.12 ≤ v < 6.12.242.6.12 ≤ v < 6.13.122.6.12 ≤ v < 6.14.32.6.12 ≤ v < 6.152.6.12 ≤ v < 6.6.882.6.13 ≤ v < 5.4.2935.11 ≤ v < 5.15.1815.16 ≤ v < 6.1.1355.5 ≤ v < 5.10.2376.13 ≤ v < 6.13.126.14 ≤ v < 6.14.36.2 ≤ v < 6.6.886.7 ≤ v < 6.12.241da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 6.15 rc1

Vendor states this is fixed in 1f6eb9fa87a781d5370c0de7794ae242f1a95ee5 (fixed)

Vendor states this is fixed in 529401c8f12ecc35f9ea5d946d5a5596cf172b48 (fixed)

Vendor states this is fixed in 6e8a6bf43cea4347121ab21bb1ed8d7bef7e732e (fixed)

Vendor states this is fixed in 99aa698dec342a07125d733e39aab4394b3b7e05 (fixed)

Vendor states this is fixed in aabc6596ffb377c4c9c8f335124b92ea282c9821 (fixed)

Vendor states this is fixed in b4c836d33ca888695b2f2665f948bc1b34fbd533 (fixed)

Vendor states this is fixed in b78f2b458f56a5a4d976c8e01c43dbf58d3ea2ca (fixed)

Vendor states this is fixed in de5a4f0cba58625e88b7bebd88f780c8c0150997 (fixed)

Vendor states this is fixed in fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8 (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 5.10.237 (unaffected)

Vendor states this is fixed in 5.15.181 (unaffected)