In the Linux kernel, the following vulnerability has been resolved:
net: ppp: Add bound checking for skb data on ppp_sync_txmung
Ensure we have enough data in linear buffer from skb before accessing
initial bytes. This prevents potential out-of-bounds accesses
when processing short packets.
When ppp_sync_txmung receives an incoming package with an empty
payload:
(remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header)
$18 = {
type = 0x1,
ver = 0x1,
code = 0x0,
sid = 0x2,
length = 0x0,
tag = 0xffff8880371cdb96
}
from the skb struct (trimmed)
tail = 0x16,
end = 0x140,
head = 0xffff88803346f400 "4",
data = 0xffff88803346f416 ":\377",
truesize = 0x380,
len = 0x0,
data_len = 0x0,
mac_len = 0xe,
hdr_len = 0x0,
it is not safe to access data[2].
[pabeni@redhat.com: fixed subj typo]
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
04 Nov 2025, 18:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/1f6eb9fa87a781d5370c0de7794ae242f1a95ee5 - Patch | |
| References | () https://git.kernel.org/stable/c/529401c8f12ecc35f9ea5d946d5a5596cf172b48 - Patch | |
| References | () https://git.kernel.org/stable/c/6e8a6bf43cea4347121ab21bb1ed8d7bef7e732e - Patch | |
| References | () https://git.kernel.org/stable/c/99aa698dec342a07125d733e39aab4394b3b7e05 - Patch | |
| References | () https://git.kernel.org/stable/c/aabc6596ffb377c4c9c8f335124b92ea282c9821 - Patch | |
| References | () https://git.kernel.org/stable/c/b4c836d33ca888695b2f2665f948bc1b34fbd533 - Patch | |
| References | () https://git.kernel.org/stable/c/b78f2b458f56a5a4d976c8e01c43dbf58d3ea2ca - Patch | |
| References | () https://git.kernel.org/stable/c/de5a4f0cba58625e88b7bebd88f780c8c0150997 - Patch | |
| References | () https://git.kernel.org/stable/c/fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - Mailing List | |
| References | () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - Mailing List | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CWE | CWE-125 | |
| First Time |
Linux linux Kernel
Debian debian Linux Linux Debian |
03 Nov 2025, 20:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 May 2025, 13:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-01 13:15
Updated : 2025-11-04 18:05
NVD link : CVE-2025-37749
Mitre link : CVE-2025-37749
CVE.ORG link : CVE-2025-37749
JSON object : View
Products Affected
linux
- linux_kernel
debian
- debian_linux
CWE
CWE-125
Out-of-bounds Read