{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39848","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.142Z","datePublished":"2025-09-19T15:26:21.403Z","dateUpdated":"2026-08-05T12:05:35.803Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:05:35.803Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nax25: properly unshare skbs in ax25_kiss_rcv()\n\nBernard Pidoux reported a regression apparently caused by commit\nc353e8983e0d (\"net: introduce per netns packet chains\").\n\nskb->dev becomes NULL and we crash in __netif_receive_skb_core().\n\nBefore above commit, different kind of bugs or corruptions could happen\nwithout a major crash.\n\nBut the root cause is that ax25_kiss_rcv() can queue/mangle input skb\nwithout checking if this skb is shared or not.\n\nMany thanks to Bernard Pidoux for his help, diagnosis and tests.\n\nWe had a similar issue years ago fixed with commit 7aaed57c5c28\n(\"phonet: properly unshare skbs in phonet_rcv()\")."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is a link-layer packet_type invoked on AX.25 frames received from an amateur-radio channel (mkiss/6pack/scc/baycom) or from raw ETH_P_BPQ Ethernet frames via bpqether, so the attacker must be on the same RF channel/digipeater network or the same Ethernet segment. AX.25 frames are not IP-routable in-kernel, matching the AV:A precedent set for the sibling netrom frame-receive CVE-2026-23098.\nAC:L - Every received AX.25 frame reaches the unshared-skb path; no crafting, timing window, or memory-layout grooming is required of the attacker, who fully controls frame content and rate. The only precondition — an AF_PACKET tap on ETH_P_AX25 placed after ptype_base — is the standard axlisten/mheardd monitoring setup present on ordinary AX.25 stations, which is how the bug was reported in the field.\nPR:N - AX.25 is entirely unauthenticated and ax25_kiss_rcv() runs on every frame before any socket, callsign, or connection state check. An attacker simply transmits on the channel or sends BPQ frames on the LAN with no credentials on the target system.\nUI:N - The frame is processed in softirq context by the receive path as soon as it arrives; no local user or administrator has to open, read, or otherwise interact with anything.\nS:U - The corruption is confined to kernel skb/socket-queue structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The shared skb is mutated (skb_pull, header resets, skb->dev/protocol rewrite) and re-queued while another consumer still reads it, so packet-socket consumers receive mis-parsed buffers, and the resulting use-after-free/list corruption of sk_buff objects yields a read primitive over freed kernel memory.\nI:H - Queueing a shared skb simultaneously onto the backlog, an AX.25 socket receive queue, and ax25->frag_queue produces sk_buff list corruption and double free, and skb_orphan() on a shared skb corrupts another socket's rmem accounting — classic heap-corruption primitives leverageable for arbitrary write and control-flow hijack.\nA:H - The reporter reproduced a hard kernel crash from a NULL skb->dev dereference in __netif_receive_skb_core(), and the underlying skb double-queue/double-free reliably panics the machine; the attacker can repeat it with every frame transmitted."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ax25/ax25_in.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"42b46684e2c78ee052d8c2ee8d9c2089233c9094","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5b079be1b9da49ad88fc304c874d4be7085f7883","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2bd0f67212908243ce88e35bf69fa77155b47b14","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"01a2984cb803f2d487b7074f9718db2bf3531f69","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7d449b7a6c8ee434d10a483feed7c5c50108cf56","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"89064cf534bea4bb28c83fe6bbb26657b19dd5fe","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b1c71d674a308d2fbc83efcf88bfc4217a86aa17","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8156210d36a43e76372312c87eb5ea3dbb405a85","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ax25/ax25_in.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.4.299","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.243","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.192","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.151","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.105","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.46","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.6","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.4.299"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.243"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.192"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.16.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/42b46684e2c78ee052d8c2ee8d9c2089233c9094"},{"url":"https://git.kernel.org/stable/c/5b079be1b9da49ad88fc304c874d4be7085f7883"},{"url":"https://git.kernel.org/stable/c/2bd0f67212908243ce88e35bf69fa77155b47b14"},{"url":"https://git.kernel.org/stable/c/01a2984cb803f2d487b7074f9718db2bf3531f69"},{"url":"https://git.kernel.org/stable/c/7d449b7a6c8ee434d10a483feed7c5c50108cf56"},{"url":"https://git.kernel.org/stable/c/89064cf534bea4bb28c83fe6bbb26657b19dd5fe"},{"url":"https://git.kernel.org/stable/c/b1c71d674a308d2fbc83efcf88bfc4217a86aa17"},{"url":"https://git.kernel.org/stable/c/8156210d36a43e76372312c87eb5ea3dbb405a85"}],"title":"ax25: properly unshare skbs in ax25_kiss_rcv()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:44:06.959Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:07:37.114Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}