Skip to main content

Linux Kernel CVE-2025-40187

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but triggering needs an authkey allocation failure under memory pressure, so AC:H; impact is kernel crash only, hence C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 08:33 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 22:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function.

AnalysisAI

Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).

Technical ContextAI

SCTP (Stream Control Transmission Protocol, RFC 4960) is a transport protocol implemented in the Linux kernel's net/sctp subsystem and is commonly used in telecom/signaling (e.g. Diameter, SIGTRAN) rather than general internet traffic. The bug lives in the connection state machine function sctp_sf_do_5_1D_ce(), which handles the COOKIE ECHO chunk during the SCTP four-way handshake. The root cause is a classic NULL-pointer dereference (CWE-476, though the record lists CWE as N/A): when the association's peer.adaptation_ind is 0, the adaptation-layer event is skipped and the ai_ev variable remains NULL/zero; separately, sctp_ulpevent_make_authkey() can return NULL on memory allocation failure. The subsequent cleanup path calls sctp_ulpevent_free() on the zero pointer, dereferencing NULL in kernel context. The upstream fix (multiple stable backport commits on git.kernel.org, e.g. 025419f4e216 and 1014b83778c8) initializes/guards the pointer before freeing.

Affected ProductsAI

The affected product is the Linux kernel, specifically builds compiled with SCTP support (CONFIG_IP_SCTP) in the net/sctp state machine. Exact vulnerable version ranges are not enumerated in the NVD data (only stable-tree fix commits are referenced: https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447 and seven sibling commits), indicating multiple maintained stable branches were patched. Distribution exposure is confirmed for Ubuntu via advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1); administrators should map their running kernel to the fixed package version listed in those USNs.

RemediationAI

Patch available per vendor advisory: upgrade to a kernel that includes the net/sctp fix. Ubuntu users should update to the fixed kernel packages named in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot; upstream/self-compiled kernels should apply the stable commits referenced on git.kernel.org (e.g. https://git.kernel.org/stable/c/025419f4e216a3ae0d0cec622262e98e8078c447). Exact upstream-tagged release versions are not stated in the input, so verify the fixed version against your distribution's changelog rather than assuming a number. As a compensating control on hosts that do not require SCTP, disable/blacklist the module (add 'install sctp /bin/true' to modprobe.d, or blacklist sctp) to remove the attack surface entirely - side effect: this breaks any application relying on SCTP (common in telecom signaling stacks). Where SCTP is needed, restrict reachability by firewalling IP protocol 132 to trusted peers only, accepting that this does not help against malicious authorized peers.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.83 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.91 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-40187 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy