CVE-2025-21642 (GCVE-0-2025-21642)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:17 – Updated: 2026-05-23 15:56
VLAI
Title
mptcp: sysctl: sched: avoid using current->nsproxy
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current->nsproxy Using the 'net' structure via 'current' is not recommended for different reasons. First, if the goal is to use it to read or write per-netns data, this is inconsistent with how the "generic" sysctl entries are doing: directly by only using pointers set to the table entry, e.g. table->data. Linked to that, the per-netns data should always be obtained from the table linked to the netns it had been created for, which may not coincide with the reader's or writer's netns. Another reason is that access to current->nsproxy->netns can oops if attempted when current->nsproxy had been dropped when the current task is exiting. This is what syzbot found, when using acct(2): Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125 Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00 RSP: 0018:ffffc900034774e8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620 RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028 RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040 R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000 R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601 __kernel_write_iter+0x318/0xa80 fs/read_write.c:612 __kernel_write+0xf6/0x140 fs/read_write.c:632 do_acct_process+0xcb0/0x14a0 kernel/acct.c:539 acct_pin_kill+0x2d/0x100 kernel/acct.c:192 pin_kill+0x194/0x7c0 fs/fs_pin.c:44 mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81 cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366 task_work_run+0x14e/0x250 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 get_signal+0x2576/0x2610 kernel/signal.c:3017 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fee3cb87a6a Code: Unable to access opcode bytes at 0x7fee3cb87a40. RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037 RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7 R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500 R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125 Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: daad878a509d69da1761106cb48c091dfe9d522d , < c0e394fd6b887e84da17e38aaa6c1c104f9c86c2 (git)
Affected: 6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8 , < 6035702381c35a8f16757332381e58b348a9eaf9 (git)
Affected: 6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8 , < d38e26e36206ae3d544d496513212ae931d1da0a (git)
Affected: 1e444f5f2a07844354ad767b44ed0a713211e26d (git)
Affected: 6.6.31 , < 6.6.72 (semver)
Affected: 6.8.10 , < 6.9 (semver)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.6.72 , ≤ 6.6.* (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21642",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:00.411729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:17.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0e394fd6b887e84da17e38aaa6c1c104f9c86c2",
              "status": "affected",
              "version": "daad878a509d69da1761106cb48c091dfe9d522d",
              "versionType": "git"
            },
            {
              "lessThan": "6035702381c35a8f16757332381e58b348a9eaf9",
              "status": "affected",
              "version": "6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8",
              "versionType": "git"
            },
            {
              "lessThan": "d38e26e36206ae3d544d496513212ae931d1da0a",
              "status": "affected",
              "version": "6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e444f5f2a07844354ad767b44ed0a713211e26d",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.72",
              "status": "affected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "6.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: sysctl: sched: avoid using current-\u003ensproxy\n\nUsing the \u0027net\u0027 structure via \u0027current\u0027 is not recommended for different\nreasons.\n\nFirst, if the goal is to use it to read or write per-netns data, this is\ninconsistent with how the \"generic\" sysctl entries are doing: directly\nby only using pointers set to the table entry, e.g. table-\u003edata. Linked\nto that, the per-netns data should always be obtained from the table\nlinked to the netns it had been created for, which may not coincide with\nthe reader\u0027s or writer\u0027s netns.\n\nAnother reason is that access to current-\u003ensproxy-\u003enetns can oops if\nattempted when current-\u003ensproxy had been dropped when the current task\nis exiting. This is what syzbot found, when using acct(2):\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI\n  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n  CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00\n  RSP: 0018:ffffc900034774e8 EFLAGS: 00010206\n\n  RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620\n  RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028\n  RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040\n  R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000\n  R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000\n  FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u003cTASK\u003e\n   proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601\n   __kernel_write_iter+0x318/0xa80 fs/read_write.c:612\n   __kernel_write+0xf6/0x140 fs/read_write.c:632\n   do_acct_process+0xcb0/0x14a0 kernel/acct.c:539\n   acct_pin_kill+0x2d/0x100 kernel/acct.c:192\n   pin_kill+0x194/0x7c0 fs/fs_pin.c:44\n   mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81\n   cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366\n   task_work_run+0x14e/0x250 kernel/task_work.c:239\n   exit_task_work include/linux/task_work.h:43 [inline]\n   do_exit+0xad8/0x2d70 kernel/exit.c:938\n   do_group_exit+0xd3/0x2a0 kernel/exit.c:1087\n   get_signal+0x2576/0x2610 kernel/signal.c:3017\n   arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n   syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218\n   do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7fee3cb87a6a\n  Code: Unable to access opcode bytes at 0x7fee3cb87a40.\n  RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037\n  RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a\n  RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003\n  RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7\n  R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500\n  R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000\n   \u003c/TASK\u003e\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:56:44.358Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0e394fd6b887e84da17e38aaa6c1c104f9c86c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6035702381c35a8f16757332381e58b348a9eaf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d38e26e36206ae3d544d496513212ae931d1da0a"
        }
      ],
      "title": "mptcp: sysctl: sched: avoid using current-\u003ensproxy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21642",
    "datePublished": "2025-01-19T10:17:59.081Z",
    "dateReserved": "2024-12-29T08:45:45.727Z",
    "dateUpdated": "2026-05-23T15:56:44.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21642",
      "date": "2026-05-27",
      "epss": "0.0002",
      "percentile": "0.05949"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21642\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:09.757\",\"lastModified\":\"2025-10-01T20:18:16.277\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: sysctl: sched: avoid using current-\u003ensproxy\\n\\nUsing the \u0027net\u0027 structure via \u0027current\u0027 is not recommended for different\\nreasons.\\n\\nFirst, if the goal is to use it to read or write per-netns data, this is\\ninconsistent with how the \\\"generic\\\" sysctl entries are doing: directly\\nby only using pointers set to the table entry, e.g. table-\u003edata. Linked\\nto that, the per-netns data should always be obtained from the table\\nlinked to the netns it had been created for, which may not coincide with\\nthe reader\u0027s or writer\u0027s netns.\\n\\nAnother reason is that access to current-\u003ensproxy-\u003enetns can oops if\\nattempted when current-\u003ensproxy had been dropped when the current task\\nis exiting. This is what syzbot found, when using acct(2):\\n\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI\\n  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\\n  CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0\\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00\\n  RSP: 0018:ffffc900034774e8 EFLAGS: 00010206\\n\\n  RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620\\n  RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028\\n  RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040\\n  R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000\\n  R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000\\n  FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601\\n   __kernel_write_iter+0x318/0xa80 fs/read_write.c:612\\n   __kernel_write+0xf6/0x140 fs/read_write.c:632\\n   do_acct_process+0xcb0/0x14a0 kernel/acct.c:539\\n   acct_pin_kill+0x2d/0x100 kernel/acct.c:192\\n   pin_kill+0x194/0x7c0 fs/fs_pin.c:44\\n   mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81\\n   cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366\\n   task_work_run+0x14e/0x250 kernel/task_work.c:239\\n   exit_task_work include/linux/task_work.h:43 [inline]\\n   do_exit+0xad8/0x2d70 kernel/exit.c:938\\n   do_group_exit+0xd3/0x2a0 kernel/exit.c:1087\\n   get_signal+0x2576/0x2610 kernel/signal.c:3017\\n   arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337\\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\\n   syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218\\n   do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  RIP: 0033:0x7fee3cb87a6a\\n  Code: Unable to access opcode bytes at 0x7fee3cb87a40.\\n  RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037\\n  RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a\\n  RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003\\n  RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7\\n  R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500\\n  R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000\\n   \u003c/TASK\u003e\\n  Modules linked in:\\n  ---[ end trace 0000000000000000 ]---\\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: sysctl: sched: evitar usar current-\u0026gt;nsproxy No se recomienda usar la estructura \u0027net\u0027 a trav\u00e9s de \u0027current\u0027 por diferentes razones. Primero, si el objetivo es usarlo para leer o escribir datos per-netns, esto es inconsistente con c\u00f3mo funcionan las entradas sysctl \\\"gen\u00e9ricas\\\": directamente usando solo punteros configurados en la entrada de la tabla, por ejemplo table-\u0026gt;data. Vinculado a eso, los datos per-netns siempre deben obtenerse de la tabla vinculada a los netns para los que se crearon, que pueden no coincidir con los netns del lector o escritor. Otra raz\u00f3n es que el acceso a current-\u0026gt;nsproxy-\u0026gt;netns puede fallar si se intenta cuando current-\u0026gt;nsproxy se ha eliminado cuando la tarea actual est\u00e1 saliendo. Esto es lo que syzbot encontr\u00f3 al usar acct(2): Oops: falla de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref en el rango [0x000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 5924 Comm: syz-executor No contaminado 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 13/09/2024 RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125 C\u00f3digo: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00 RSP: 0018:ffffc900034774e8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620 RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028 RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040 R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000 R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000 FS: 000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601 __kernel_write_iter+0x318/0xa80 fs/read_write.c:612 __kernel_write+0xf6/0x140 fs/read_write.c:632 do_acct_process+0xcb0/0x14a0 kernel/acct.c:539 acct_pin_kill+0x2d/0x100 kernel/acct.c:192 pin_kill+0x194/0x7c0 fs/fs_pin.c:44 mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81 cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366 task_work_run+0x14e/0x250 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [en l\u00ednea] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 get_signal+0x2576/0x2610 kernel/signal.c:3017 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 bucle de salida al modo usuario kernel/entry/common.c:111 [en l\u00ednea] preparaci\u00f3n de salida al modo usuario include/linux/entry-common.h:329 [en l\u00ednea] __syscall_salir_al_modo_usuario_work kernel/entry/common.c:207 [en l\u00ednea] syscall_salir_al_modo_usuario+0x150/0x2a0 kernel/entry/common.c:218 hacer_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entrada_SYSCALL_64_despu\u00e9s_de_hwframe+0x77/0x7f RIP: 0033:0x7fee3cb87a6a C\u00f3digo: No se puede acceder a los bytes del c\u00f3digo de operaci\u00f3n en 0x7fee3cb87a40. RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037 RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a RDX: 0000000000000041 RSI: 000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7 R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500 R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000  M\u00f3dulos vinculados en: ---[ fin del seguimiento 000000000000000 ]--- RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125 C\u00f3digo: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.31\",\"versionEndExcluding\":\"6.6.72\",\"matchCriteriaId\":\"9F913E6A-CCED-484D-A146-3E76CA41A917\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8.10\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"9CCA7E3C-BB2C-4B9B-835E-9E71ECC0C539\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6035702381c35a8f16757332381e58b348a9eaf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0e394fd6b887e84da17e38aaa6c1c104f9c86c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d38e26e36206ae3d544d496513212ae931d1da0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21642\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:54:00.411729Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:55:40.368Z\"}}], \"cna\": {\"title\": \"mptcp: sysctl: sched: avoid using current-\u003ensproxy\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"daad878a509d69da1761106cb48c091dfe9d522d\", \"lessThan\": \"c0e394fd6b887e84da17e38aaa6c1c104f9c86c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8\", \"lessThan\": \"6035702381c35a8f16757332381e58b348a9eaf9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6963c508fd7ab66ae0b7ae3db9a62ca6267f1ae8\", \"lessThan\": \"d38e26e36206ae3d544d496513212ae931d1da0a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e444f5f2a07844354ad767b44ed0a713211e26d\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mptcp/ctrl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.72\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/ctrl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c0e394fd6b887e84da17e38aaa6c1c104f9c86c2\"}, {\"url\": \"https://git.kernel.org/stable/c/6035702381c35a8f16757332381e58b348a9eaf9\"}, {\"url\": \"https://git.kernel.org/stable/c/d38e26e36206ae3d544d496513212ae931d1da0a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: sysctl: sched: avoid using current-\u003ensproxy\\n\\nUsing the \u0027net\u0027 structure via \u0027current\u0027 is not recommended for different\\nreasons.\\n\\nFirst, if the goal is to use it to read or write per-netns data, this is\\ninconsistent with how the \\\"generic\\\" sysctl entries are doing: directly\\nby only using pointers set to the table entry, e.g. table-\u003edata. Linked\\nto that, the per-netns data should always be obtained from the table\\nlinked to the netns it had been created for, which may not coincide with\\nthe reader\u0027s or writer\u0027s netns.\\n\\nAnother reason is that access to current-\u003ensproxy-\u003enetns can oops if\\nattempted when current-\u003ensproxy had been dropped when the current task\\nis exiting. This is what syzbot found, when using acct(2):\\n\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI\\n  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\\n  CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0\\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00\\n  RSP: 0018:ffffc900034774e8 EFLAGS: 00010206\\n\\n  RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620\\n  RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028\\n  RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040\\n  R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000\\n  R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000\\n  FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601\\n   __kernel_write_iter+0x318/0xa80 fs/read_write.c:612\\n   __kernel_write+0xf6/0x140 fs/read_write.c:632\\n   do_acct_process+0xcb0/0x14a0 kernel/acct.c:539\\n   acct_pin_kill+0x2d/0x100 kernel/acct.c:192\\n   pin_kill+0x194/0x7c0 fs/fs_pin.c:44\\n   mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81\\n   cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366\\n   task_work_run+0x14e/0x250 kernel/task_work.c:239\\n   exit_task_work include/linux/task_work.h:43 [inline]\\n   do_exit+0xad8/0x2d70 kernel/exit.c:938\\n   do_group_exit+0xd3/0x2a0 kernel/exit.c:1087\\n   get_signal+0x2576/0x2610 kernel/signal.c:3017\\n   arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337\\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\\n   syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218\\n   do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  RIP: 0033:0x7fee3cb87a6a\\n  Code: Unable to access opcode bytes at 0x7fee3cb87a40.\\n  RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037\\n  RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a\\n  RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003\\n  RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7\\n  R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500\\n  R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000\\n   \u003c/TASK\u003e\\n  Modules linked in:\\n  ---[ end trace 0000000000000000 ]---\\n  RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125\\n  Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.72\", \"versionStartIncluding\": \"6.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T13:06:02.582Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21642\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T19:57:17.369Z\", \"dateReserved\": \"2024-12-29T08:45:45.727Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-19T10:17:59.081Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.