GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40187 (GCVE-0-2025-40187)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08
VLAI
Title
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < 1014b83778c8677f1d7a57c26dc728baa801ac62 (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < 7f702f85df0266ed7b5bab81ba50394c92f3c928 (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < dbceedc0213e75bf3e9f9f9e2f66b10699d004fe (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < 025419f4e216a3ae0d0cec622262e98e8078c447 (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < c21f45cfa4a9526b34d76b397c9ef080668b6e73 (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < d0e8f1445c19b1786759ba72a38267e1449bab7e (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < badbd79313e6591616c1b78e29a9b71efed7f035 (git)
Affected: 30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b , < 2f3119686ef50319490ccaec81a575973da98815 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.157 , ≤ 6.1.* (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1014b83778c8677f1d7a57c26dc728baa801ac62",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "7f702f85df0266ed7b5bab81ba50394c92f3c928",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "dbceedc0213e75bf3e9f9f9e2f66b10699d004fe",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "025419f4e216a3ae0d0cec622262e98e8078c447",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "c21f45cfa4a9526b34d76b397c9ef080668b6e73",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "d0e8f1445c19b1786759ba72a38267e1449bab7e",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "badbd79313e6591616c1b78e29a9b71efed7f035",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            },
            {
              "lessThan": "2f3119686ef50319490ccaec81a575973da98815",
              "status": "affected",
              "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()\n\nIf new_asoc-\u003epeer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0\nand sctp_ulpevent_make_authkey() returns 0, then the variable\nai_ev remains zero and the zero will be dereferenced\nin the sctp_ulpevent_free() function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the SCTP state machine\u0027s COOKIE ECHO handler, driven entirely by chunks received from a remote peer over IP, and is reached from `sctp_rcv()` in NET_RX softirq context. Any host with a listening SCTP socket (telecom SIGTRAN/M3UA/Diameter signalling nodes are routinely inter-carrier and internet facing) is remotely reachable.\nAC:L - The attacker deterministically controls both selectable preconditions by simply omitting the Adaptation Layer Indication parameter (leaving `ai_ev` NULL) and omitting the SCTP-AUTH parameters (forcing the `sctp_ulpevent_make_authkey()` call), which are the default characteristics of a plain handshake. The only remaining factor is the GFP_ATOMIC allocation failing, which the attacker can influence by flooding the target with concurrent association attempts and traffic to exhaust atomic reserves \u2014 particularly effective on the memory-constrained embedded/telecom devices where SCTP is deployed.\nPR:N - SCTP association establishment is entirely unauthenticated; the attacker only needs to complete the standard INIT / INIT-ACK / COOKIE ECHO exchange against a listening socket, with the state cookie having been minted by the victim itself. No credentials, capabilities, or local account are involved anywhere along the path.\nUI:N - Exploitation requires nothing from any local user or administrator beyond the pre-existing condition that an SCTP service is listening. The attacker drives the entire handshake unilaterally.\nS:U - The NULL dereference faults inside the kernel handling the same network stack that received the packet; there is no crossing into another security authority such as a hypervisor, IOMMU, or sandbox boundary.\nC:N - The dereference is a read of `event-\u003emsg_flags` at a fixed low offset from NULL, which faults immediately; no data is returned to the attacker and no kernel memory contents are disclosed.\nI:N - The bug is a read fault on a NULL pointer with no write, no out-of-bounds access, and no object lifetime confusion, so no kernel data is modified and no control-flow hijack primitive is produced.\nA:H - The dereference occurs in NET_RX softirq context, producing a fatal exception in interrupt \u2014 a kernel panic and complete loss of availability, or at minimum an oops that kills the softirq path (and an immediate panic on the `panic_on_oops` configurations common in embedded and telecom deployments). The attacker can repeat the attempt indefinitely across reboots."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:25.629Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1014b83778c8677f1d7a57c26dc728baa801ac62"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f702f85df0266ed7b5bab81ba50394c92f3c928"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbceedc0213e75bf3e9f9f9e2f66b10699d004fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447"
        },
        {
          "url": "https://git.kernel.org/stable/c/c21f45cfa4a9526b34d76b397c9ef080668b6e73"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0e8f1445c19b1786759ba72a38267e1449bab7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/badbd79313e6591616c1b78e29a9b71efed7f035"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f3119686ef50319490ccaec81a575973da98815"
        }
      ],
      "title": "net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40187",
    "datePublished": "2025-11-12T21:56:29.504Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:25.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40187",
      "date": "2026-09-20",
      "epss": "0.00595",
      "percentile": "0.47128"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/sm_statefuns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1014b83778c8677f1d7a57c26dc728baa801ac62",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7f702f85df0266ed7b5bab81ba50394c92f3c928",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbceedc0213e75bf3e9f9f9e2f66b10699d004fe",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "025419f4e216a3ae0d0cec622262e98e8078c447",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c21f45cfa4a9526b34d76b397c9ef080668b6e73",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0e8f1445c19b1786759ba72a38267e1449bab7e",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "badbd79313e6591616c1b78e29a9b71efed7f035",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f3119686ef50319490ccaec81a575973da98815",
                    "status": "affected",
                    "version": "30f6ebf65bc46161c5aaff1db2e6e7c76aa4a06b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/sm_statefuns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.301",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()\n\nIf new_asoc-\u003epeer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0\nand sctp_ulpevent_make_authkey() returns 0, then the variable\nai_ev remains zero and the zero will be dereferenced\nin the sctp_ulpevent_free() function."
          }
        ],
        "id": "CVE-2025-40187",
        "lastModified": "2026-07-30T06:24:16.763",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T22:15:45.577",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1014b83778c8677f1d7a57c26dc728baa801ac62"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2f3119686ef50319490ccaec81a575973da98815"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7f702f85df0266ed7b5bab81ba50394c92f3c928"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/badbd79313e6591616c1b78e29a9b71efed7f035"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c21f45cfa4a9526b34d76b397c9ef080668b6e73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0e8f1445c19b1786759ba72a38267e1449bab7e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dbceedc0213e75bf3e9f9f9e2f66b10699d004fe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T17:59:55+00:00",
      "cve": "CVE-2025-40187",
      "id": "CVE-2025-40187",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40187.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:47:14Z",
      "cve": "CVE-2025-40187",
      "id": "CVE-2025-40187",
      "initial_release_date": "2025-11-15T00:24:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "642",
      "product_status:known_not_affected": "204",
      "product_status:recommended": "366",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40187",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40187.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.