In the Linux kernel, the following vulnerability has been resolved:
sctp: sysctl: auth_enable: avoid using current->nsproxy
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 607.0,
"function_hash": "232695885818721795347579651781672927943"
},
"id": "CVE-2025-21638-00b34dc4",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd2a2939423566c654545fa3e96a656662a0af9e",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_auth"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 607.0,
"function_hash": "232695885818721795347579651781672927943"
},
"id": "CVE-2025-21638-19b4cf52",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf387cdebfaebae228dfba162f94c567a67610c3",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_auth"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 607.0,
"function_hash": "232695885818721795347579651781672927943"
},
"id": "CVE-2025-21638-2c78277b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_auth"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 607.0,
"function_hash": "232695885818721795347579651781672927943"
},
"id": "CVE-2025-21638-5dac5070",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_auth"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154401869467167326624126547162698050716",
"243949712008030359587054450774618173244",
"85342868127185904160867385295444719003",
"308492551826178522920319070767384667089"
]
},
"id": "CVE-2025-21638-623cd7af",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd2a2939423566c654545fa3e96a656662a0af9e",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154401869467167326624126547162698050716",
"243949712008030359587054450774618173244",
"85342868127185904160867385295444719003",
"308492551826178522920319070767384667089"
]
},
"id": "CVE-2025-21638-68bf1e31",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250959323593754604027025178915877321683",
"243949712008030359587054450774618173244",
"85342868127185904160867385295444719003",
"308492551826178522920319070767384667089"
]
},
"id": "CVE-2025-21638-763b3f92",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15649fd5415eda664ef35780c2013adeb5d9c695",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154401869467167326624126547162698050716",
"243949712008030359587054450774618173244",
"85342868127185904160867385295444719003",
"308492551826178522920319070767384667089"
]
},
"id": "CVE-2025-21638-7f3f70c3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 613.0,
"function_hash": "232719825037839400729245349646631074767"
},
"id": "CVE-2025-21638-c4b65a9a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15649fd5415eda664ef35780c2013adeb5d9c695",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_auth"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180727810149142099799069873195762094948",
"117487363088853973171781545036947297274",
"85342868127185904160867385295444719003",
"308492551826178522920319070767384667089"
]
},
"id": "CVE-2025-21638-e145e7d1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf387cdebfaebae228dfba162f94c567a67610c3",
"target": {
"file": "net/sctp/sysctl.c"
}
}
]