{"id":"CVE-2025-39673","revision":"8b641310cef0497abab379905e84d4da","records":[{"revision":"8b641310cef0497abab379905e84d4da","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39673","aliases":[],"title":"ppp: fix race conditions in ppp_fill_forward_path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix race conditions in ppp_fill_forward_path\n\nppp_fill_forward_path() has two race conditions:\n\n1. The ppp->channels list can change between list_empty() and\n   list_first_entry(), as ppp_lock() is not held. If the only channel\n   is deleted in ppp_disconnect_channel(), list_first_entry() may\n   access an empty head or a freed entry, and trigger a panic.\n\n2. pch->chan can be NULL. When ppp_unregister_channel() is called,\n   pch->chan is set to NULL before pch is removed from ppp->channels.\n\nFix these by using a lockless RCU approach:\n- Use list_first_or_null_rcu() to safely test and access the first list\n  entry.\n- Convert list modifications on ppp->channels to their RCU variants and\n  add synchronize_net() after removal.\n- Check for a NULL pch->chan before dereferencing it.","state":0,"publishedAt":"2025-09-05T17:20:38.769+00:00","modifiedAt":"2026-10-15T22:02:29.786+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ppp/ppp_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"0f1630be6fcca3f0c63e4b242ad202e5cde28a40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"ca18d751bcc9faf5b7e82e9fae1223d103928181\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"94731cc551e29511d85aa8dec61a6c071b1f2430\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"f97f6475fdcb3c28ff3c55cc4b7bde632119ec08\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f6efc675c9dd8d93f826b79ae7e33e03301db609\",\n                            \"lessThan\": \"0417adf367a0af11adf7ace849af4638cfb573f7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ppp/ppp_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.190\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.149\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.103\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.44\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.4\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7","https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40","https://git.kernel.org/stable/c/ca18d751bcc9faf5b7e82e9fae1223d103928181","https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430","https://git.kernel.org/stable/c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08","https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39673","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39673","identifiers":["CVE-2025-39673"]},"retained":false,"historicalAffected":[]}],"coverage":[]}