CVE-2025-39950
- Source
- https://cve.org/CVERecord?id=CVE-2025-39950
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39950.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-39950
- Downstream
- Published
- 2025-10-04T07:31:10.926Z
- Modified
- 2026-03-13T03:13:23.703690Z
- Summary
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
A NULL pointer dereference can occur in tcpaofinishconnect() during a connect() system call on a socket with a TCP-AO key added and TCPREPAIR enabled.
The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation.
Fix this by checking if skb is NULL before dereferencing it.
The commentary is taken from bpfskopsestablished(), which is also called in the same flow. Unlike the function being patched, bpfskopsestablished() validates the skb before dereferencing it.
int main(void){ struct sockaddrin sockaddr; struct tcpaoadd tcpao; int sk; int one = 1;
memset(&sockaddr,'\0',sizeof(sockaddr)); memset(&tcp_ao,'\0',sizeof(tcp_ao)); sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); sockaddr.sin_family = AF_INET; memcpy(tcp_ao.alg_name,"cmac(aes128)",12); memcpy(tcp_ao.key,"ABCDEFGHABCDEFGH",16); tcp_ao.keylen = 16; memcpy(&tcp_ao.addr,&sockaddr,sizeof(sockaddr)); setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tcp_ao, sizeof(tcp_ao)); setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one)); sockaddr.sin_family = AF_INET; sockaddr.sin_port = htobe16(123); inet_aton("127.0.0.1", &sockaddr.sin_addr); connect(sk,(struct sockaddr *)&sockaddr,sizeof(sockaddr));return 0; }
$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn
BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcpaofinishconnect (net/ipv4/tcpao.c:1182)
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39950.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2e7bba08923ebc675b1f0e0e0959e68e53047838
- https://git.kernel.org/stable/c/5f445eb259906b61a518487a790e11d07d31738c
- https://git.kernel.org/stable/c/993b734d31ab804747ac961b1ee664b023c3b5fa
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39950.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-39950
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7c2ffaf21bd67f73d21560995ce17eaf5fc1d37fFixed5f445eb259906b61a518487a790e11d07d31738cFixed993b734d31ab804747ac961b1ee664b023c3b5faFixed2e7bba08923ebc675b1f0e0e0959e68e53047838