In the Linux kernel, the following vulnerability has been resolved:
net: ppp: Add bound checking for skb data on pppsynctxmung
Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets.
When pppsynctxmung receives an incoming package with an empty payload: (remote) gef➤ p *(struct pppoehdr *) (skb->head + skb->networkheader) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 }
from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, datalen = 0x0, maclen = 0xe, hdr_len = 0x0,
it is not safe to access data[2].
[pabeni@redhat.com: fixed subj typo]
[
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5a4f0cba58625e88b7bebd88f780c8c0150997",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-07480045"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f6eb9fa87a781d5370c0de7794ae242f1a95ee5",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-13eb936c"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4c836d33ca888695b2f2665f948bc1b34fbd533",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-215d852d"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5a4f0cba58625e88b7bebd88f780c8c0150997",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-569bba49"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f6eb9fa87a781d5370c0de7794ae242f1a95ee5",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-579e09a0"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@529401c8f12ecc35f9ea5d946d5a5596cf172b48",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-65b5bfa0"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@529401c8f12ecc35f9ea5d946d5a5596cf172b48",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-6f13020a"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b78f2b458f56a5a4d976c8e01c43dbf58d3ea2ca",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-7eceb073"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b78f2b458f56a5a4d976c8e01c43dbf58d3ea2ca",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-80908eb9"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabc6596ffb377c4c9c8f335124b92ea282c9821",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-864686da"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99aa698dec342a07125d733e39aab4394b3b7e05",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-98a39c52"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-ad030aff"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e8a6bf43cea4347121ab21bb1ed8d7bef7e732e",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-b3502979"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aabc6596ffb377c4c9c8f335124b92ea282c9821",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-cab090af"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e8a6bf43cea4347121ab21bb1ed8d7bef7e732e",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-e46c2828"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99aa698dec342a07125d733e39aab4394b3b7e05",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-e9c38209"
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57048587244299545503636782174996684533",
"28778717746254337438072093164665394623",
"161013195193174282901424998970296959801"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4c836d33ca888695b2f2665f948bc1b34fbd533",
"target": {
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-eea95998"
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 873.0,
"function_hash": "296502079684797531480382971634006890694"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8",
"target": {
"function": "ppp_sync_txmunge",
"file": "drivers/net/ppp/ppp_synctty.c"
},
"id": "CVE-2025-37749-ffd53489"
}
]