High 8.8Published Sep 19, 2025

CVE-2025-39848ax25: properly unshare skbs in ax25_kiss_rcv()

Updated under an hour ago (Oct 27, 2026, 3:30 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 42b46684e2c78ee052d8c2ee8d9c2089233c9094; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5b079be1b9da49ad88fc304c874d4be7085f7883; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2bd0f67212908243ce88e35bf69fa77155b47b14; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 01a2984cb803f2d487b7074f9718db2bf3531f69; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7d449b7a6c8ee434d10a483feed7c5c50108cf56; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 89064cf534bea4bb28c83fe6bbb26657b19dd5fe; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b1c71d674a308d2fbc83efcf88bfc4217a86aa17; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8156210d36a43e76372312c87eb5ea3dbb405a85	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.4.299; from 5.5 before 5.10.243; from 5.11 before 5.15.192; from 5.16 before 6.1.151; from 6.2 before 6.6.105; from 6.7 before 6.12.46; from 6.13 before 6.16.6; 2.6.12; and 8 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/42b46684e2c78ee052d8c2ee8d9c2089233c9094	patch
https://git.kernel.org/stable/c/5b079be1b9da49ad88fc304c874d4be7085f7883	patch
https://git.kernel.org/stable/c/2bd0f67212908243ce88e35bf69fa77155b47b14	patch
https://git.kernel.org/stable/c/01a2984cb803f2d487b7074f9718db2bf3531f69	patch
https://git.kernel.org/stable/c/7d449b7a6c8ee434d10a483feed7c5c50108cf56	patch
https://git.kernel.org/stable/c/89064cf534bea4bb28c83fe6bbb26657b19dd5fe	patch
https://git.kernel.org/stable/c/b1c71d674a308d2fbc83efcf88bfc4217a86aa17	patch
https://git.kernel.org/stable/c/8156210d36a43e76372312c87eb5ea3dbb405a85	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.