NetSight
IP …
high7.1

CVE-2025-21638

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit o…

Impact

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.10.41 before 3.11
from 3.12.20 before 3.13
from 3.14.5 before 5.4.290
from 5.5 before 5.10.234
from 5.11 before 5.15.177
from 5.16 before 6.1.125

Weakness classification

CWE-476

References