CVE-2025-39847

What it actually does

Memory leak in pad_compress_skb when alloc_skb fails: the original skb reference is lost and never freed by the caller, causing gradual kernel memory exhaustion in PPP compression paths.

Why it matters to the business

Systems using PPP networking may experience increasing memory pressure, degraded performance, or eventual denial of service after prolonged operation; high downstream Linux kernel usage amplifies exposure across servers and embedded devices.

How an attack unfolds

An attacker with local access triggers repeated PPP packet compression operations that force alloc_skb failures inside pad_compress_skb; each failure leaks an skb, accumulating until memory pressure causes system instability. No public exploits or ransomware campaigns are associated, though related Linux kernel issues have been linked to actors such as VMSCAPE.

How to fix it

Update the Linux kernel to the fixed commit 9ca6a040f76c0b149293e430dabab446f3fc8ab7 or later stable releases that align pad_compress_skb semantics with realloc behavior and preserve the original skb on failure.

How to confirm the fix worked

Confirm the presence of commit 9ca6a040f76c0b149293e430dabab446f3fc8ab7 in the kernel source tree; test PPP compression paths under low-memory conditions to verify no skb leaks occur on alloc failure.

Typical attack path

1. Obtain local code execution or access on a Linux system with PPP enabled
2. Craft or replay network traffic that exercises pad_compress_skb under memory pressure
3. Induce repeated alloc_skb failures to trigger the leak path
4. Monitor for gradual memory growth leading to OOM conditions

How to detect it

Review kernel memory statistics and slab allocator usage for unusual skb growth correlated with PPP activity; examine system logs for repeated pad_compress_skb allocation failures and cross-reference with process or network traces showing sustained PPP traffic.

What your security team should do

• Prioritize kernel upgrades on all systems exposing PPP interfaces within the next maintenance window
• Monitor EPSS and exploit maturity trends for any increase in activity
• Audit PPP usage and disable the protocol where not required to reduce attack surface
• Incorporate memory-leak regression tests for networking subsystems into CI pipelines