CVE-2025-21640

What it actually does

Null pointer dereference in Linux kernel SCTP sysctl cookie_hmac_alg handler when current->nsproxy is accessed during task exit, instead of safely obtaining net structure via container_of on table->data.

Why it matters to the business

Local denial of service via kernel oops on systems using SCTP networking, leading to crashes during routine operations such as accounting or sysctl access; high prevalence in Linux environments increases operational disruption risk.

How an attack unfolds

A local attacker triggers the flaw by performing SCTP-related sysctl operations or syscalls like acct(2) while the current task is exiting, causing current->nsproxy to be NULL and resulting in a kernel null-ptr-deref oops; observed in syzbot testing and noted in broader 2024 zero-day Linux kernel campaigns by espionage and financially motivated actors.

How to fix it

Apply the upstream kernel fix from commit 5599b212d2f4466e1832a94e9932684aaa364587 or later; update affected packages to the listed fixed versions such as 2:0.12.1.2-2.491.el6_8.3 where applicable and rebuild or reboot systems after patching.

How to confirm the fix worked

Verify kernel source includes the container_of change for table->data, confirm no current->nsproxy usage remains in sctp sysctl code, and test sysctl reads/writes plus acct(2) under exiting task scenarios for absence of oops.

Typical attack path

1. Gain local user access on a Linux system with SCTP enabled
2. Interact with SCTP sysctl interfaces or invoke acct(2) during process exit conditions
3. Trigger access to net structure via current->nsproxy leading to NULL dereference
4. Cause kernel oops resulting in system instability or crash

How to detect it

Search kernel logs and dmesg for null-ptr-deref oops mentioning sctp, sysctl, cookie_hmac_alg, nsproxy, or container_of during acct or sysctl activity; review audit logs for unusual SCTP sysctl or process accounting events around crash times.

• kernel: BUG: unable to handle kernel NULL pointer dereference
• sctp cookie_hmac_alg
• current->nsproxy
• acct(2) task exit

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all Linux deployments given ecosystem prevalence
• Monitor for related kernel oops reports in logs as an interim detection measure
• Restrict untrusted local access and SCTP usage until patched
• Review and test patches in staging environments before broad rollout