CVE-2025-23142

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then sctp_sendmsg_to_asoc() sets the selected transport in all the message chunks to be sent. There's a possible race condition if another thread triggers the removal of that selected transport, for instance, by explicitly unbinding an address with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have b...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= df132eff463873e14e019a07f387b4d577d6d1f9 < 547762250220325d350d0917a7231480e0f4142b, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 3257386be6a7eb8a8bfc9cbfb746df4eb4fc70e8, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 0f7df4899299ce4662e5f95badb9dbc57cc37fa5, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 7a63f4fb0efb4e69efd990cbb740a848679ec4b0, >= df132eff463873e14e019a07f387b4d577d6d1f9 < c6fefcb71d246baaf3bacdad1af7ff50ebcfe652, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 9e7c37fadb3be1fc33073fcf10aa96d166caa697, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 5bc83bdf5f5b8010d1ca5a4555537e62413ab4e2, >= df132eff463873e14e019a07f387b4d577d6d1f9 < 2e5068b7e0ae0a54f6cfd03a2f80977da657f1ee, >= df132eff463873e14e019a07f387b4d577d6d1f9 < f1a69a940de58b16e8249dff26f74c8cc59b32be, >= 26e51e5287eed4d96ea66a3da95429f42940f013, >= 8b97e045bd6d37f96f161e4d371ae174148e1587, >= e044554e97e812eb257d073bcc130e0ea653858f, >= 8376fdc999be008f0e9918db52f1ed8c08f5a1c9, >= cd947138e8c31e8cfcd489c12e9b97271beb6e79, >= 3.18.128 < 3.19, >= 4.4.166 < 4.5, >= 4.9.142 < 4.10, >= 4.14.85 < 4.15, >= 4.19.6 < 4.20, >= 4.20

Fixed versions

3.19, 4.5, 4.10, 4.15, 5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416