CVE-2025-39848

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

Rincian

Terbit di NVD

19 September 2025

Terakhir diubah

30 Juli 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/01a2984cb803f2d487b7074f9718db2bf3531f69 patch
• https://git.kernel.org/stable/c/2bd0f67212908243ce88e35bf69fa77155b47b14 patch
• https://git.kernel.org/stable/c/42b46684e2c78ee052d8c2ee8d9c2089233c9094 patch
• https://git.kernel.org/stable/c/5b079be1b9da49ad88fc304c874d4be7085f7883 patch
• https://git.kernel.org/stable/c/7d449b7a6c8ee434d10a483feed7c5c50108cf56 patch
• https://git.kernel.org/stable/c/8156210d36a43e76372312c87eb5ea3dbb405a85 patch
• https://git.kernel.org/stable/c/89064cf534bea4bb28c83fe6bbb26657b19dd5fe patch
• https://git.kernel.org/stable/c/b1c71d674a308d2fbc83efcf88bfc4217a86aa17 patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html