NetSight
IP …
high8.8

CVE-2025-39848

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparen…

Impact

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12.1 before 5.4.299
from 5.5 before 5.10.243
from 5.11 before 5.15.192
from 5.16 before 6.1.151
from 6.2 before 6.6.105
from 6.7 before 6.12.46
DebianDebian Linux
Version 11.0

Weakness classification

CWE-401

References