CVE-2025-21641

What it actually does

Null pointer dereference in the Linux kernel MPTCP sysctl blackhole timeout handler caused by accessing network namespace information through current->nsproxy, which can be NULL during task exit.

Why it matters to the business

Local users can trigger kernel oops leading to system instability or denial of service on affected Linux systems; the issue has low exploitation probability and is not known to be used in ransomware.

How an attack unfolds

An attacker with local access invokes system calls such as acct(2) that cause the current task to exit while current->nsproxy is NULL; the MPTCP sysctl code path then attempts the invalid dereference, producing a kernel oops.

How to fix it

Upgrade the Linux kernel to a version containing commit 4c74fbdc5ab95b13945be01e6065940b68222db7; for Red Hat systems apply the listed fixed IBM Java packages where applicable.

How to confirm the fix worked

Verify the running kernel contains the fix commit or matches the supplied fixed package versions; attempt to reproduce the original syzbot reproducer and confirm absence of null-ptr-deref oops.

Typical attack path

1. Obtain local shell access on a vulnerable Linux kernel
2. Invoke acct(2) or equivalent operation that exits the current task
3. Trigger MPTCP sysctl blackhole timeout code path
4. Cause null pointer dereference and kernel oops

How to detect it

Search kernel logs for oops or null-ptr-deref entries mentioning mptcp, nsproxy, or blackhole timeout; correlate with process exit events involving acct.

• null-ptr-deref
• mptcp
• nsproxy
• blackhole_timeout
• acct

What your security team should do

• Apply the kernel fix or updated packages immediately on all exposed systems
• Monitor for kernel oops reports referencing mptcp and nsproxy
• Restrict untrusted local accounts until patching is complete