AZL-67589
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-67589.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-67589
- Upstream
- Published
- 2025-09-19T16:15:43Z
- Modified
- 2026-04-01T05:21:15.363006Z
- Summary
- CVE-2025-39848 affecting package kernel for versions less than 6.6.112.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ax25: properly unshare skbs in ax25kissrcv()
Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains").
skb->dev becomes NULL and we crash in _netifreceiveskbcore().
Before above commit, different kind of bugs or corruptions could happen without a major crash.
But the root cause is that ax25kissrcv() can queue/mangle input skb without checking if this skb is shared or not.
Many thanks to Bernard Pidoux for his help, diagnosis and tests.
We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").
- References