In the Linux kernel, the following vulnerability has been resolved:
ax25: properly unshare skbs in ax25kissrcv()
Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains").
skb->dev becomes NULL and we crash in _netifreceiveskbcore().
Before above commit, different kind of bugs or corruptions could happen without a major crash.
But the root cause is that ax25kissrcv() can queue/mangle input skb without checking if this skb is shared or not.
Many thanks to Bernard Pidoux for his help, diagnosis and tests.
We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").
[
{
"deprecated": false,
"id": "CVE-2025-39848-0c761ae7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1c71d674a308d2fbc83efcf88bfc4217a86aa17",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-0d5d813b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a2984cb803f2d487b7074f9718db2bf3531f69",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-2f677c2e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b079be1b9da49ad88fc304c874d4be7085f7883",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-373c06de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d449b7a6c8ee434d10a483feed7c5c50108cf56",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "335577814988891549003174400036433099897",
"length": 396.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-40a6e0aa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1c71d674a308d2fbc83efcf88bfc4217a86aa17",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "335577814988891549003174400036433099897",
"length": 396.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-468c2ec2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd0f67212908243ce88e35bf69fa77155b47b14",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "93103690087926831244436048218633905957",
"length": 390.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-519b15e1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42b46684e2c78ee052d8c2ee8d9c2089233c9094",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "93103690087926831244436048218633905957",
"length": 390.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-551082e0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89064cf534bea4bb28c83fe6bbb26657b19dd5fe",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-638463c2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89064cf534bea4bb28c83fe6bbb26657b19dd5fe",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "335577814988891549003174400036433099897",
"length": 396.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-67f75dfd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a2984cb803f2d487b7074f9718db2bf3531f69",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "335577814988891549003174400036433099897",
"length": 396.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-77ff0e94",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b079be1b9da49ad88fc304c874d4be7085f7883",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "93103690087926831244436048218633905957",
"length": 390.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-a322aa39",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d449b7a6c8ee434d10a483feed7c5c50108cf56",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-c1e43148",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8156210d36a43e76372312c87eb5ea3dbb405a85",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-c94bedbc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8156210d36a43e76372312c87eb5ea3dbb405a85",
"target": {
"file": "net/ax25/ax25_in.c",
"function": "ax25_kiss_rcv"
},
"digest": {
"function_hash": "335577814988891549003174400036433099897",
"length": 396.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-ca8a3af0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42b46684e2c78ee052d8c2ee8d9c2089233c9094",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39848-cc9408f4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd0f67212908243ce88e35bf69fa77155b47b14",
"target": {
"file": "net/ax25/ax25_in.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"29045728209133289773053778038453558710",
"323216973957302152579554551765049683881",
"64680231740245327089141035315173910492",
"124166466648681428858755597546681223441"
]
}
}
]