CVE-2025-21640 Information

Description

In the Linux kernel the following vulnerability has been resolved:

sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy

As mentioned in a previous commit of this series using the ’net' structure via ‘current’ is not recommended for different reasons:

• Inconsistency: getting info from the reader’s/writer’s netns vs only from the opener’s netns.

• current->nsproxy can be NULL in some cases resulting in an ‘Oops’ (null-ptr-deref) e.g. when the current task is exiting as spotted by syzbot [1] using acct(2).

The ’net’ structure can be obtained from the table->data using container_of().

Note that table->data could also be used directly as this is the only member needed from the ’net’ structure but that would increase the size of this fix to use ‘data’ everywhere ’net->sctp.sctp_hmac_alg’ is used.

Reference

https://git.kernel.org/stable/c/3cd0659deb9c03535fd61839e91d4d4d3e51ac71 https://git.kernel.org/stable/c/ad673e514b2793b8d5902f6ba6ab7e890dea23d5 https://git.kernel.org/stable/c/ea62dd1383913b5999f3d16ae99d411f41b528d4 https://git.kernel.org/stable/c/f0bb3935470684306e4e04793a20ac4c4b08de0b