CVE-2025-21636

What it actually does

Null pointer dereference in SCTP plpmtud_probe_interval sysctl handler due to reliance on current->nsproxy instead of deriving net structure from table->data, leading to kernel oops when nsproxy is NULL.

Why it matters to the business

Potential system crashes or denial of service on Linux systems using SCTP networking, with low immediate risk given stable low exploit probability and no known active campaigns.

How an attack unfolds

An attacker triggers SCTP sysctl access (via acct or similar) during task exit scenarios where nsproxy is NULL, causing the kernel to dereference a null pointer and crash.

How to fix it

Apply the upstream kernel fix from commit 1dc5da6c4178f3e4b95c631418f72de9f86c0449 or later stable releases; update affected packages such as chromium-browser to 52.0.2743.116-1.el6 on Red Hat systems.

How to confirm the fix worked

Verify kernel source contains the container_of usage for net structure in the plpmtud_probe_interval handler and confirm no direct current->nsproxy access remains; test sysctl operations under task exit conditions.

Typical attack path

1. Identify or create conditions where a task is exiting while SCTP sysctls are accessed
2. Perform sysctl read or write on net.sctp.probe_interval
3. Trigger null dereference in the handler path using current->nsproxy
4. Cause kernel oops and potential system instability or reboot

How to detect it

Review kernel logs for null pointer dereference oops involving SCTP or sysctl paths; correlate with process exit events or acct(2) usage around the time of crash.

What your security team should do

• Prioritize kernel updates on systems with SCTP enabled
• Monitor for related syzbot or fuzzing reports in the SCTP sysctl code path
• Apply the specific fixed commit to custom kernels before deployment