Medium 5.5Published Jan 19, 2025

CVE-2025-21639sctp: sysctl: rto_min/max: avoid using current->nsproxy

Updated under an hour ago (Oct 27, 2026, 11:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.

CVSS: 5.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9; from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before 246428bfb9e7db15c5cd08e1d0eca41b65af2b06; 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 builds before 0f78f09466744589e420935e646ae78212a38290; from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before 4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482; from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f; from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before c87f1f6ade56c711f8736901e330685b453e420e; from 4f3fdf3bc59cafd14c3bc2c2369efad34c7aa8b5 before 9fc17b76fc70763780aa78b38fcf4742384044a5	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP

References

References

https://git.kernel.org/stable/c/c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9
https://git.kernel.org/stable/c/246428bfb9e7db15c5cd08e1d0eca41b65af2b06
https://git.kernel.org/stable/c/0f78f09466744589e420935e646ae78212a38290
https://git.kernel.org/stable/c/4059507e34aa5fe0fa9fd5b2b5f0c8b26ab2d482
https://git.kernel.org/stable/c/dc9d0e3cfd16f66fbf0862857c6b391c8613ca9f
https://git.kernel.org/stable/c/c87f1f6ade56c711f8736901e330685b453e420e
https://git.kernel.org/stable/c/9fc17b76fc70763780aa78b38fcf4742384044a5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.