CVE-2025-39673

What it actually does

Race conditions in ppp_fill_forward_path allow list modification between checks without ppp_lock held or pch->chan becoming NULL before removal from ppp->channels, leading to use-after-free, NULL dereference, or kernel panic.

Why it matters to the business

Unprivileged local users can trigger kernel panics on Linux systems using PPP networking, causing denial of service, loss of network connectivity, and potential service disruption on servers or containers; prevalence in the Linux kernel ecosystem increases exposure across many deployments.

How an attack unfolds

An attacker with local access manipulates PPP channels via ppp_disconnect_channel or ppp_unregister_channel while ppp_fill_forward_path executes, racing the list_empty/list_first_entry or NULL check to trigger a panic; no named threat actors are associated with this specific flaw.

How to fix it

Upgrade the Linux kernel to the fixed commit 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7 or later stable releases containing the RCU-based list handling and NULL checks; apply patches promptly given the 417 days since publication.

How to confirm the fix worked

Verify kernel source contains the RCU list_first_or_null_rcu usage, synchronize_net after channel removal, and pch->chan NULL guard; confirm no panic occurs under concurrent channel add/remove stress tests.

Typical attack path

1. Obtain local unprivileged access on a Linux system with PPP enabled
2. Create and manipulate PPP channels to trigger concurrent list modifications
3. Invoke ppp_fill_forward_path during the window where channels list changes or chan becomes NULL
4. Cause kernel panic via invalid list access or NULL dereference

How to detect it

Review kernel logs for ppp-related oops or panic traces involving list traversal or channel pointers; correlate with PPP channel creation/deletion events in system audit logs.

What your security team should do

• Prioritize kernel upgrades on all systems using PPP within the next maintenance window
• Monitor for related privilege-escalation patterns in Container-Optimized OS environments
• Restrict unprivileged access to PPP interfaces where feasible until patched
• Test fixed kernels in staging before broad deployment