CVE-2025-40240

CVE-2025-40240

High · published December 4, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid NULL dereference when chunk data buffer is missing

chunk->skb pointer is dereferenced in the if-block where it's supposed

to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list

instead and do it just before replacing chunk->skb. We're sure that

otherwise chunk->skb is non-NULL because of outer if() condition.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.1th percentile
Published
2025-12-04T21:16Z
References (8)
https://git.kernel.org/stable/c/03e80a4b04ef1fb2c61dd63216ab8d3a5dcb196f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/08165c296597075763130919f2aae59b5822f016 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/441f0647f7673e0e64d4910ef61a5fb8f16bfb82 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4f6da435fb5d8a21cbf8cae5ca5a2ba0e1012b71 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/61cda2777b07d27459f5cac5a047c3edf9c8a1a9 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a832b0f99be19df608cb75c023f8027b1789bd1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89b465b54227c245ddc7cc9ed822231af21123ef · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cb9055ba30306ede4ad920002233d0659982f1cb · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 04 DEC 15:31Z
    sctp: avoid NULL dereference when chunk data buffer is missing
    cvelistv5