{"id":"CVE-2025-21639","revision":"535b7815d3a74b81adf972df7816d83f","records":[{"revision":"535b7815d3a74b81adf972df7816d83f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21639","aliases":[],"title":"sctp: sysctl: rto_min/max: avoid using current->nsproxy","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: rto_min/max: avoid using current->nsproxy\n\nAs mentioned in a previous commit of this series, using the 'net'\nstructure via 'current' is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader's/writer's netns vs only\n  from the opener's netns.\n\n- current->nsproxy can be NULL in some cases, resulting in an 'Oops'\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe 'net' structure can be obtained from the table->data using\ncontainer_of().\n\nNote that table->data could also be used directly, as this is the only\nmember needed from the 'net' structure, but that would increase the size\nof this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.","state":0,"publishedAt":"2025-01-19T10:17:56.828+00:00","modifiedAt":"2026-10-15T01:02:42.114+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/sysctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"246428bfb9e7db15c5cd08e1d0eca41b65af2b06\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"0f78f09466744589e420935e646ae78212a38290\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"c87f1f6ade56c711f8736901e330685b453e420e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5\",\n                            \"lessThan\": \"9fc17b76fc70763780aa78b38fcf4742384044a5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sctp/sysctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.290\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.234\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.177\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.125\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.72\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.10\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9","https://git.kernel.org/stable/c/246428bfb9e7db15c5cd08e1d0eca41b65af2b06","https://git.kernel.org/stable/c/0f78f09466744589e420935e646ae78212a38290","https://git.kernel.org/stable/c/4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482","https://git.kernel.org/stable/c/dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f","https://git.kernel.org/stable/c/c87f1f6ade56c711f8736901e330685b453e420e","https://git.kernel.org/stable/c/9fc17b76fc70763780aa78b38fcf4742384044a5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21639","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21639","identifiers":["CVE-2025-21639"]},"retained":false,"historicalAffected":[]}],"coverage":[]}