CVE-2025-21639

What it actually does

The vulnerability permits a null pointer dereference in SCTP sysctl handlers for rto_min and rto_max by accessing the net namespace via current->nsproxy, which can be NULL during task exit, resulting in a kernel oops.

Why it matters to the business

Linux systems using SCTP may suffer unexpected kernel crashes during sysctl interactions or process termination, causing service disruptions, downtime, and operational instability on affected servers.

How an attack unfolds

A local attacker triggers the flaw through sysctl reads or writes on SCTP parameters or by initiating process exit conditions such as acct(2), exploiting unsafe namespace access that leads to null dereference and system instability.

How to fix it

Apply the upstream fix by updating to a Linux kernel containing commit c8d179f3b1c1d60bf4484f50aa67b4c70f91bff9, which replaces current->nsproxy access with container_of on table->data.

How to confirm the fix worked

Confirm the presence of the fix commit in kernel sources, recompile if needed, and verify that sysctl operations on SCTP parameters succeed without oops under process exit conditions.

Typical attack path

1. Gain local user access on a Linux system
2. Perform SCTP-related sysctl operations or trigger task exit paths
3. Induce null pointer dereference causing kernel oops

How to detect it

Inspect kernel logs for oops messages referencing sctp sysctl or nsproxy null dereference, particularly correlated with acct or sysctl activity.

What your security team should do

• Patch affected Linux kernels promptly to the fixed commit
• Review and restrict unnecessary local access on SCTP-enabled systems
• Enable kernel panic logging and monitoring for sctp-related oops