CVE-2025-39848

What it actually does

ax25_kiss_rcv() queues or modifies an input skb without unsharing it when shared, causing skb->dev to become NULL and triggering a crash in __netif_receive_skb_core().

Why it matters to the business

Systems running affected Linux kernels with AX.25 networking enabled may experience unexpected crashes or data corruption when processing certain network packets, leading to denial of service and operational disruption; low exploitability and no ransomware use reduce urgency.

How an attack unfolds

An attacker with local access or the ability to inject AX.25 frames sends crafted packets to ax25_kiss_rcv(); the function operates on a shared skb, corrupting skb->dev and crashing the receive path. Threat actors such as VMSCAPE have been linked to similar kernel privilege-escalation patterns in container environments.

How to fix it

Update the Linux kernel to a version containing commit 42b46684e2c78ee052d8c2ee8d9c2089233c9094 or later; Debian users should install liblwp-protocol-https-perl 6.04-3 or newer on Debian 11-14.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable version; test AX.25 receive paths with shared skbs to confirm no crash occurs.

Typical attack path

1. Obtain local access or network adjacency to deliver AX.25 traffic
2. Trigger ax25_kiss_rcv() with a shared skb via crafted packet
3. Cause skb->dev to be NULL during __netif_receive_skb_core() processing
4. Induce kernel crash or memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing ax25_kiss_rcv or __netif_receive_skb_core after the 2025-09-19 publication date; correlate with AX.25 traffic in network captures.

What your security team should do

• Prioritize kernel upgrades on systems exposing AX.25 interfaces
• Monitor for kernel oops or crashes involving __netif_receive_skb_core
• Apply fixes within standard patch windows given low EPSS and no KEV status