CVE-2025-22062

What it actually does

Missing serialization between sctp_udp_sock_stop() and sctp_udp_sock_start() in proc_sctp_do_udp_port() allows concurrent access leading to null pointer dereference during kernel_sock_shutdown and udp_tunnel_sock_release.

Why it matters to the business

Unpatched Linux systems risk kernel crashes and service disruption when SCTP UDP port configuration is accessed under concurrent load, increasing downtime for network-dependent workloads.

How an attack unfolds

An attacker with local access triggers concurrent sysctl or proc operations on SCTP UDP port settings, racing the stop and start socket routines to dereference an invalid pointer and crash the kernel, as demonstrated by syzbot reports.

How to fix it

Apply the kernel commit 65ccb2793da7401772a3ffe85355c831b313c59f or upgrade affected Red Hat packages to the listed fixed versions such as squid 7:4.15-3.module+el8.6.0+22491+132fca59.7 and libecap 0:1.0.1-2.module+el8.1.0+4044+36416a77 on rhel_aus, rhel_e4s, and rhel_tus streams.

How to confirm the fix worked

Verify kernel version includes commit 65ccb2793da7401772a3ffe85355c831b313c59f, confirm package versions match the fixed module strings, and test concurrent SCTP UDP port configuration changes under load without triggering oops.

Typical attack path

1. Obtain local user access on affected Linux kernel
2. Issue concurrent calls to proc_sctp_do_udp_port via sysctl or /proc interfaces
3. Trigger sctp_udp_sock_stop and sctp_udp_sock_start without serialization
4. Cause null pointer dereference in kernel_sock_shutdown
5. Result in kernel panic or oops

How to detect it

Search kernel logs for oops messages containing kernel_sock_shutdown, udp_tunnel_sock_release, sctp_udp_sock_stop, and proc_sctp_do_udp_port along with KASAN null-ptr-deref reports around address 0x0000000000000068.

• kernel_sock_shutdown+0x47/0x70
• udp_tunnel_sock_release+0x68/0x80
• sctp_udp_sock_stop+0x71/0x160
• proc_sctp_do_udp_port+0x264/0x450
• KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]

What your security team should do

• Prioritize kernel and squid package updates on all Red Hat systems matching the affected streams
• Monitor for kernel oops involving kernel_sock_shutdown and udp_tunnel_sock_release
• Restrict untrusted local access to sysctl SCTP interfaces until patched
• Review EPSS trend and schedule testing within standard change windows given low exploit maturity