CVE-2025-21637 (GCVE-0-2025-21637)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:17 – Updated: 2026-08-05 11:53
VLAI
Title
sctp: sysctl: udp_port: avoid using current->nsproxy
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 0a0966312ac3eedd7f5f2a766ed4702df39a9a65 (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < e919197fb8616331f5dc81e4c3cc3d12769cb725 (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 55627918febdf9d71107a1e68d1528dc591c9a15 (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 5b77d73f3be5102720fb685b9e6900e3500e1096 (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < c10377bbc1972d858eaf0ab366a311b39f8ef1b6 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.177 , ≤ 5.15.* (semver)
Unaffected: 6.1.125 , ≤ 6.1.* (semver)
Unaffected: 6.6.72 , ≤ 6.6.* (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:10.551212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:17.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:58:15.076Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a0966312ac3eedd7f5f2a766ed4702df39a9a65",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "e919197fb8616331f5dc81e4c3cc3d12769cb725",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "55627918febdf9d71107a1e68d1528dc591c9a15",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "5b77d73f3be5102720fb685b9e6900e3500e1096",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "c10377bbc1972d858eaf0ab366a311b39f8ef1b6",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: udp_port: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the \u0027net\u0027\nstructure via \u0027current\u0027 is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader\u0027s/writer\u0027s netns vs only\n  from the opener\u0027s netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an \u0027Oops\u0027\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe \u0027net\u0027 structure can be obtained from the table-\u003edata using\ncontainer_of().\n\nNote that table-\u003edata could also be used directly, but that would\nincrease the size of this fix, while \u0027sctp.ctl_sock\u0027 still needs to be\nretrieved from \u0027net\u0027 structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Despite living in net/sctp/, the vulnerable function is a procfs sysctl -\u003eproc_handler reachable only through local file I/O on /proc/sys/net/sctp/udp_port and local syscalls (acct(2), write(2)); no received SCTP or UDP packet ever reaches it.\nAC:L - Both trigger paths are fully deterministic and entirely attacker-driven \u2014 either unshare/open/SCM_RIGHTS/write for the netns-confusion path, or acct(2) plus `umount -l` plus process exit for the NULL deref \u2014 with no race, no victim state, and no memory-layout dependency.\nPR:L - An unprivileged user can reach the flaw via `unshare -Urn`, since cap_capable() grants the owner of a child user namespace CAP_NET_ADMIN over it (security/commoncap.c:92), letting a process still in the init netns write through the child\u0027s sysctl fd and have the handler act on init_net; no real root is needed for that path.\nUI:N - The attacker performs every step from its own cooperating processes \u2014 namespace creation, fd passing, the write, or its own exit \u2014 with no action required from any other user or administrator.\nS:U - The flawed code and the affected resources are both kernel network-namespace state within the same kernel security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:N - The NULL+offset dereference faults before returning any data, and the read side of the netns confusion only reports the caller\u0027s own netns value for a world-readable (0644) setting, so no protected information is disclosed.\nI:H - The netns confusion lets an unprivileged local user write init_net.sctp.udp_port and drive sctp_udp_sock_stop()/sctp_udp_sock_start() on the host namespace, fully controlling whether and on which port the host kernel decapsulates SCTP from UDP \u2014 an attacker-chosen modification of protected host network state and a bypass of SCTP packet filtering.\nA:H - The NULL-ptr-deref oops fires inside do_exit() while acct-\u003elock is held, wedging the exiting task with a stuck mutex and pinned mount and panicking outright on panic_on_oops builds; separately, the cross-netns write destroys the host\u0027s SCTP UDP tunnel sockets, severing SCTP-over-UDP connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:17.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a0966312ac3eedd7f5f2a766ed4702df39a9a65"
        },
        {
          "url": "https://git.kernel.org/stable/c/e919197fb8616331f5dc81e4c3cc3d12769cb725"
        },
        {
          "url": "https://git.kernel.org/stable/c/55627918febdf9d71107a1e68d1528dc591c9a15"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b77d73f3be5102720fb685b9e6900e3500e1096"
        },
        {
          "url": "https://git.kernel.org/stable/c/c10377bbc1972d858eaf0ab366a311b39f8ef1b6"
        }
      ],
      "title": "sctp: sysctl: udp_port: avoid using current-\u003ensproxy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21637",
    "datePublished": "2025-01-19T10:17:55.321Z",
    "dateReserved": "2024-12-29T08:45:45.726Z",
    "dateUpdated": "2026-08-05T11:53:17.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21637",
      "date": "2026-08-06",
      "epss": "0.00207",
      "percentile": "0.10945"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21637\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:09.217\",\"lastModified\":\"2026-07-30T06:16:41.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: sysctl: udp_port: avoid using current-\u003ensproxy\\n\\nAs mentioned in a previous commit of this series, using the \u0027net\u0027\\nstructure via \u0027current\u0027 is not recommended for different reasons:\\n\\n- Inconsistency: getting info from the reader\u0027s/writer\u0027s netns vs only\\n  from the opener\u0027s netns.\\n\\n- current-\u003ensproxy can be NULL in some cases, resulting in an \u0027Oops\u0027\\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\\n  syzbot [1] using acct(2).\\n\\nThe \u0027net\u0027 structure can be obtained from the table-\u003edata using\\ncontainer_of().\\n\\nNote that table-\u003edata could also be used directly, but that would\\nincrease the size of this fix, while \u0027sctp.ctl_sock\u0027 still needs to be\\nretrieved from \u0027net\u0027 structure.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sctp: sysctl: udp_port: evitar usar current-\u0026gt;nsproxy Como se mencion\u00f3 en un commit anterior de esta serie, no se recomienda usar la estructura \u0027net\u0027 a trav\u00e9s de \u0027current\u0027 por diferentes razones: - Inconsistencia: obtener informaci\u00f3n de los netns del lector/escritor vs solo de los netns del abridor. - current-\u0026gt;nsproxy puede ser NULL en algunos casos, lo que resulta en un \u0027Oops\u0027 (null-ptr-deref), p. ej. cuando la tarea actual est\u00e1 saliendo, como lo detect\u00f3 syzbot [1] usando acct(2). La estructura \u0027net\u0027 se puede obtener de table-\u0026gt;data usando Container_of(). Tenga en cuenta que table-\u0026gt;data tambi\u00e9n se puede usar directamente, pero eso aumentar\u00eda el tama\u00f1o de esta correcci\u00f3n, mientras que \u0027sctp.ctl_sock\u0027 a\u00fan necesita ser recuperado de la estructura \u0027net\u0027.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sctp/sysctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"0a0966312ac3eedd7f5f2a766ed4702df39a9a65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"e919197fb8616331f5dc81e4c3cc3d12769cb725\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"55627918febdf9d71107a1e68d1528dc591c9a15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"5b77d73f3be5102720fb685b9e6900e3500e1096\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"c10377bbc1972d858eaf0ab366a311b39f8ef1b6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sctp/sysctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.177\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.125\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.72\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:54:10.551212Z\",\"id\":\"CVE-2025-21637\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.177\",\"matchCriteriaId\":\"71A3AFDC-A3CA-454F-8917-E998BBDE36F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.125\",\"matchCriteriaId\":\"9AFD566B-ECC6-46F1-92F7-12A615D5685F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.72\",\"matchCriteriaId\":\"33E12097-C88A-45B4-9677-2A961A08DD3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"02D604F6-10D1-4F7B-A022-0888406A1121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a0966312ac3eedd7f5f2a766ed4702df39a9a65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55627918febdf9d71107a1e68d1528dc591c9a15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b77d73f3be5102720fb685b9e6900e3500e1096\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c10377bbc1972d858eaf0ab366a311b39f8ef1b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e919197fb8616331f5dc81e4c3cc3d12769cb725\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:13:50+00:00",
      "cve": "CVE-2025-21637",
      "id": "CVE-2025-21637",
      "initial_release_date": "2025-01-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: sysctl: udp_port: avoid using current-\u003ensproxy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21637.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:52:52Z",
      "cve": "CVE-2025-21637",
      "id": "CVE-2025-21637",
      "initial_release_date": "2025-01-20T03:47:47Z",
      "product_status:known_affected": "524",
      "product_status:known_not_affected": "192",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21637",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21637.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:58:15.076Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21637\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:54:10.551212Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:55:23.332Z\"}}], \"cna\": {\"title\": \"sctp: sysctl: udp_port: avoid using current-\u003ensproxy\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Despite living in net/sctp/, the vulnerable function is a procfs sysctl -\u003eproc_handler reachable only through local file I/O on /proc/sys/net/sctp/udp_port and local syscalls (acct(2), write(2)); no received SCTP or UDP packet ever reaches it.\\nAC:L - Both trigger paths are fully deterministic and entirely attacker-driven \\u2014 either unshare/open/SCM_RIGHTS/write for the netns-confusion path, or acct(2) plus `umount -l` plus process exit for the NULL deref \\u2014 with no race, no victim state, and no memory-layout dependency.\\nPR:L - An unprivileged user can reach the flaw via `unshare -Urn`, since cap_capable() grants the owner of a child user namespace CAP_NET_ADMIN over it (security/commoncap.c:92), letting a process still in the init netns write through the child\u0027s sysctl fd and have the handler act on init_net; no real root is needed for that path.\\nUI:N - The attacker performs every step from its own cooperating processes \\u2014 namespace creation, fd passing, the write, or its own exit \\u2014 with no action required from any other user or administrator.\\nS:U - The flawed code and the affected resources are both kernel network-namespace state within the same kernel security authority; no hypervisor, IOMMU, or VM boundary is crossed.\\nC:N - The NULL+offset dereference faults before returning any data, and the read side of the netns confusion only reports the caller\u0027s own netns value for a world-readable (0644) setting, so no protected information is disclosed.\\nI:H - The netns confusion lets an unprivileged local user write init_net.sctp.udp_port and drive sctp_udp_sock_stop()/sctp_udp_sock_start() on the host namespace, fully controlling whether and on which port the host kernel decapsulates SCTP from UDP \\u2014 an attacker-chosen modification of protected host network state and a bypass of SCTP packet filtering.\\nA:H - The NULL-ptr-deref oops fires inside do_exit() while acct-\u003elock is held, wedging the exiting task with a stuck mutex and pinned mount and panicking outright on panic_on_oops builds; separately, the cross-netns write destroys the host\u0027s SCTP UDP tunnel sockets, severing SCTP-over-UDP connectivity.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"046c052b475e7119b6a30e3483e2888fc606a2f8\", \"lessThan\": \"0a0966312ac3eedd7f5f2a766ed4702df39a9a65\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"046c052b475e7119b6a30e3483e2888fc606a2f8\", \"lessThan\": \"e919197fb8616331f5dc81e4c3cc3d12769cb725\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"046c052b475e7119b6a30e3483e2888fc606a2f8\", \"lessThan\": \"55627918febdf9d71107a1e68d1528dc591c9a15\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"046c052b475e7119b6a30e3483e2888fc606a2f8\", \"lessThan\": \"5b77d73f3be5102720fb685b9e6900e3500e1096\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"046c052b475e7119b6a30e3483e2888fc606a2f8\", \"lessThan\": \"c10377bbc1972d858eaf0ab366a311b39f8ef1b6\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sctp/sysctl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.177\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.125\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.72\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sctp/sysctl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0a0966312ac3eedd7f5f2a766ed4702df39a9a65\"}, {\"url\": \"https://git.kernel.org/stable/c/e919197fb8616331f5dc81e4c3cc3d12769cb725\"}, {\"url\": \"https://git.kernel.org/stable/c/55627918febdf9d71107a1e68d1528dc591c9a15\"}, {\"url\": \"https://git.kernel.org/stable/c/5b77d73f3be5102720fb685b9e6900e3500e1096\"}, {\"url\": \"https://git.kernel.org/stable/c/c10377bbc1972d858eaf0ab366a311b39f8ef1b6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: sysctl: udp_port: avoid using current-\u003ensproxy\\n\\nAs mentioned in a previous commit of this series, using the \u0027net\u0027\\nstructure via \u0027current\u0027 is not recommended for different reasons:\\n\\n- Inconsistency: getting info from the reader\u0027s/writer\u0027s netns vs only\\n  from the opener\u0027s netns.\\n\\n- current-\u003ensproxy can be NULL in some cases, resulting in an \u0027Oops\u0027\\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\\n  syzbot [1] using acct(2).\\n\\nThe \u0027net\u0027 structure can be obtained from the table-\u003edata using\\ncontainer_of().\\n\\nNote that table-\u003edata could also be used directly, but that would\\nincrease the size of this fix, while \u0027sctp.ctl_sock\u0027 still needs to be\\nretrieved from \u0027net\u0027 structure.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.177\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.125\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.72\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:17.199Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21637\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:17.199Z\", \"dateReserved\": \"2024-12-29T08:45:45.726Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-19T10:17:55.321Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.