Critical 9.8Published Sep 5, 2025

CVE-2025-39673ppp: fix race conditions in ppp_fill_forward_path

Updated under an hour ago (Oct 26, 2026, 12:50 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f6efc675c9dd8d93f826b79ae7e33e03301db609 before 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7; from f6efc675c9dd8d93f826b79ae7e33e03301db609 before 0f1630be6fcca3f0c63e4b242ad202e5cde28a40; from f6efc675c9dd8d93f826b79ae7e33e03301db609 before ca18d751bcc9faf5b7e82e9fae1223d103928181; from f6efc675c9dd8d93f826b79ae7e33e03301db609 before 94731cc551e29511d85aa8dec61a6c071b1f2430; from f6efc675c9dd8d93f826b79ae7e33e03301db609 before f97f6475fdcb3c28ff3c55cc4b7bde632119ec08; from f6efc675c9dd8d93f826b79ae7e33e03301db609 before 0417adf367a0af11adf7ace849af4638cfb573f7	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4; 6.17; 6.17	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7	patch
https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40	patch
https://git.kernel.org/stable/c/ca18d751bcc9faf5b7e82e9fae1223d103928181	patch
https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430	patch
https://git.kernel.org/stable/c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08	patch
https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.