In the Linux kernel, the following vulnerability has been resolved:
sctp: sysctl: cookiehmacalg: avoid using current->nsproxy
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctphmacalg' is used.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323832520592980986019480345562895504428",
"243949712008030359587054450774618173244",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-0c31c225",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86ddf8118123cb58a0fb8724cad6979c4069065b",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 937.0,
"function_hash": "275192198971569917968802223176350565943"
},
"id": "CVE-2025-21640-1107c553",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad673e514b2793b8d5902f6ba6ab7e890dea23d5",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180727810149142099799069873195762094948",
"117487363088853973171781545036947297274",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-1316e7fc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5599b212d2f4466e1832a94e9932684aaa364587",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"138179041250866471928446353086904519061",
"243949712008030359587054450774618173244",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-18889601",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea62dd1383913b5999f3d16ae99d411f41b528d4",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 937.0,
"function_hash": "275192198971569917968802223176350565943"
},
"id": "CVE-2025-21640-35910e74",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ca51faba2b017bf6c90e139434c4117d0afcdc",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 943.0,
"function_hash": "315499738397058617566631056421995863067"
},
"id": "CVE-2025-21640-49c85d12",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea62dd1383913b5999f3d16ae99d411f41b528d4",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"138179041250866471928446353086904519061",
"243949712008030359587054450774618173244",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-6073c2f2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0bb3935470684306e4e04793a20ac4c4b08de0b",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323832520592980986019480345562895504428",
"243949712008030359587054450774618173244",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-92b9f276",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad673e514b2793b8d5902f6ba6ab7e890dea23d5",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 937.0,
"function_hash": "275192198971569917968802223176350565943"
},
"id": "CVE-2025-21640-9f173a57",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86ddf8118123cb58a0fb8724cad6979c4069065b",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 943.0,
"function_hash": "315499738397058617566631056421995863067"
},
"id": "CVE-2025-21640-a94a526c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0bb3935470684306e4e04793a20ac4c4b08de0b",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323832520592980986019480345562895504428",
"243949712008030359587054450774618173244",
"298797597624559129060101053001747036829",
"198273461847295952456167646921345416135"
]
},
"id": "CVE-2025-21640-b23204f8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03ca51faba2b017bf6c90e139434c4117d0afcdc",
"target": {
"file": "net/sctp/sysctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 937.0,
"function_hash": "275192198971569917968802223176350565943"
},
"id": "CVE-2025-21640-d900af5f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5599b212d2f4466e1832a94e9932684aaa364587",
"target": {
"file": "net/sctp/sysctl.c",
"function": "proc_sctp_do_hmac_alg"
}
}
]