In the Linux kernel, the following vulnerability has been resolved:
sctp: initialize more fields in sctpv6from_sk()
syzbot found that sin6scopeid was not properly initialized, leading to undefined behavior.
Clear sin6scopeid and sin6_flowinfo.
BUG: KMSAN: uninit-value in _sctpv6cmpaddr+0x887/0x8c0 net/sctp/ipv6.c:649 _sctpv6cmpaddr+0x887/0x8c0 net/sctp/ipv6.c:649 sctpinet6cmpaddr+0x4f2/0x510 net/sctp/ipv6.c:983 sctpbindaddrconflict+0x22a/0x3b0 net/sctp/bindaddr.c:390 sctpgetportlocal+0x21eb/0x2440 net/sctp/socket.c:8452 sctpgetport net/sctp/socket.c:8523 [inline] sctplistenstart net/sctp/socket.c:8567 [inline] sctpinetlisten+0x710/0xfd0 net/sctp/socket.c:8636 _syslistensocket net/socket.c:1912 [inline] _syslisten net/socket.c:1927 [inline] _dosyslisten net/socket.c:1932 [inline] _sesyslisten net/socket.c:1930 [inline] _x64syslisten+0x343/0x4c0 net/socket.c:1930 x64syscall+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls64.h:51 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xd9/0x210 arch/x86/entry/syscall64.c:94 entrySYSCALL64after_hwframe+0x77/0x7f
Local variable addr.i.i created at: sctpgetport net/sctp/socket.c:8515 [inline] sctplistenstart net/sctp/socket.c:8567 [inline] sctpinetlisten+0x650/0xfd0 net/sctp/socket.c:8636 _syslistensocket net/socket.c:1912 [inline] _syslisten net/socket.c:1927 [inline] _dosyslisten net/socket.c:1932 [inline] _sesyslisten net/socket.c:1930 [inline] _x64syslisten+0x343/0x4c0 net/socket.c:1930
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2025/39xxx/CVE-2025-39812.json"
}[
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-08ed2a49",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9546934c2054bba1bd605c44e936619159a34027",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-0bc537af",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bbc0c02aea1f1c405bd1271466889c25a1fe01b",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-1b1a9656",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9546934c2054bba1bd605c44e936619159a34027",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-22d7244a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6c2cc99fc2387ba6499facd6108f6543382792d",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-6f25dece",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@463aa96fca6209bb205f49f7deea3817d7ddaa3a",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-a5ca68bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6c2cc99fc2387ba6499facd6108f6543382792d",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-ad2a78ec",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b4693d8bab5370cfcb44a275b4d8dcb06e56bf",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-bbaef5c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b4693d8bab5370cfcb44a275b4d8dcb06e56bf",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-cc1d8ff1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bbc0c02aea1f1c405bd1271466889c25a1fe01b",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-e940a862",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@463aa96fca6209bb205f49f7deea3817d7ddaa3a",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"201941101239140756386301311081224911056",
"127292231900089928339518014606349687521",
"178163858749258873659625708388572717945",
"107308650079346504119737469150937187270",
"158760699480518877684882464143560154403"
],
"threshold": 0.9
},
"id": "CVE-2025-39812-f222572a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17d6c7747045e9b802c2f5dfaba260d309d831ae",
"target": {
"file": "net/sctp/ipv6.c"
},
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "101006061458273438737631057843262737395",
"length": 181.0
},
"id": "CVE-2025-39812-fa432848",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17d6c7747045e9b802c2f5dfaba260d309d831ae",
"target": {
"file": "net/sctp/ipv6.c",
"function": "sctp_v6_from_sk"
},
"deprecated": false
}
]