In the Linux kernel, the following vulnerability has been resolved:
ppp: fix memory leak in padcompressskb
If allocskb() fails in padcompress_skb(), it returns NULL without releasing the old skb. The caller does:
skb = pad_compress_skb(ppp, skb);
if (!skb)
goto drop;
drop: kfree_skb(skb);
When padcompressskb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.
Align padcompressskb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the newskb variable so the original skb is not lost when padcompress_skb() fails.
[
{
"id": "CVE-2025-39847-000c781c",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "ppp_send_frame"
},
"digest": {
"function_hash": "92381091404528526474508200540115664310",
"length": 2433.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ca6a040f76c0b149293e430dabab446f3fc8ab7",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-09f32b16",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "pad_compress_skb"
},
"digest": {
"function_hash": "331988424219287095171138322693817832501",
"length": 1009.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ca6a040f76c0b149293e430dabab446f3fc8ab7",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-5c465dc5",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "pad_compress_skb"
},
"digest": {
"function_hash": "331988424219287095171138322693817832501",
"length": 1009.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-6355728c",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "pad_compress_skb"
},
"digest": {
"function_hash": "331988424219287095171138322693817832501",
"length": 1009.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b21e9cd4559102da798bdcba453b64ecd7be7ee",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-70f0b5fc",
"target": {
"file": "drivers/net/ppp/ppp_generic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"276636255120100706561140157212978319432",
"55829420223695408849192385140628696563",
"168932883713912060084761680093108038223",
"8308544490015562216543838113310104136",
"109277469889237095925664481820540532921",
"183979913570224277252247881574250061579",
"219958819775903306392194923039033473121",
"183530889483296138570307612122907848057",
"3859885813748848713060688504156912300",
"149942529086438987781671592107618920575"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b21e9cd4559102da798bdcba453b64ecd7be7ee",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-b8a023c7",
"target": {
"file": "drivers/net/ppp/ppp_generic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"276636255120100706561140157212978319432",
"55829420223695408849192385140628696563",
"168932883713912060084761680093108038223",
"8308544490015562216543838113310104136",
"109277469889237095925664481820540532921",
"183979913570224277252247881574250061579",
"219958819775903306392194923039033473121",
"183530889483296138570307612122907848057",
"3859885813748848713060688504156912300",
"149942529086438987781671592107618920575"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ca6a040f76c0b149293e430dabab446f3fc8ab7",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-c60a16af",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "ppp_send_frame"
},
"digest": {
"function_hash": "92381091404528526474508200540115664310",
"length": 2433.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-cb027d0d",
"target": {
"file": "drivers/net/ppp/ppp_generic.c",
"function": "ppp_send_frame"
},
"digest": {
"function_hash": "92381091404528526474508200540115664310",
"length": 2433.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b21e9cd4559102da798bdcba453b64ecd7be7ee",
"signature_version": "v1"
},
{
"id": "CVE-2025-39847-ed66fecc",
"target": {
"file": "drivers/net/ppp/ppp_generic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"276636255120100706561140157212978319432",
"55829420223695408849192385140628696563",
"168932883713912060084761680093108038223",
"8308544490015562216543838113310104136",
"109277469889237095925664481820540532921",
"183979913570224277252247881574250061579",
"219958819775903306392194923039033473121",
"183530889483296138570307612122907848057",
"3859885813748848713060688504156912300",
"149942529086438987781671592107618920575"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8",
"signature_version": "v1"
}
]