CVE-2025-21638

What it actually does

The flaw allows a null pointer dereference in the SCTP sysctl handler for auth_enable when current->nsproxy is NULL (e.g., during task exit via acct(2)), causing a kernel oops instead of safely obtaining the net namespace via container_of on table->data.

Why it matters to the business

Local users or automated processes can trigger kernel crashes on systems using SCTP sysctls, leading to denial of service, potential data corruption, and operational disruption in networked environments reliant on the Linux kernel.

How an attack unfolds

An attacker with local access invokes a sysctl read/write on the sctp.auth_enable entry while the current task is exiting (nullifying nsproxy), or uses similar paths spotted by syzbot; this was noted in broader 2024 zero-day campaigns targeting Linux kernel memory issues by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to a version containing commit cf387cdebfaebae228dfba162f94c567a67610c3 or later stable releases; apply vendor-specific kernel updates for affected distributions and verify SCTP sysctl handling uses container_of on table->data.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or later; test sysctl access to sctp.auth_enable under task-exit conditions and verify no null-ptr-deref oops occurs; review kernel logs for resolved crashes.

Typical attack path

1. Obtain local access to a Linux system with SCTP enabled
2. Trigger sysctl access to sctp.auth_enable while inducing a task exit condition (e.g., via acct(2))
3. Cause current->nsproxy to be NULL leading to dereference in the handler
4. Trigger kernel oops and system instability or crash

How to detect it

Search kernel logs for null-ptr-deref oops involving sctp or sysctl auth_enable; correlate with process exit events or acct(2) usage; review audit logs for unusual sysctl access patterns on SCTP parameters.

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within the next maintenance window due to memory corruption risk
• Monitor for local privilege abuse targeting SCTP sysctls
• Disable unnecessary SCTP functionality where possible until patched
• Review and apply the exact fixed commit across all GIT-based deployments