CVE-2025-37749

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ppp: Add bound checking for skb data on ppp_sync_txmung<br /> <br /> Ensure we have enough data in linear buffer from skb before accessing<br /> initial bytes. This prevents potential out-of-bounds accesses<br /> when processing short packets.<br /> <br /> When ppp_sync_txmung receives an incoming package with an empty<br /> payload:<br /> (remote) gef➤ p *(struct pppoe_hdr *) (skb-&gt;head + skb-&gt;network_header)<br /> $18 = {<br /> type = 0x1,<br /> ver = 0x1,<br /> code = 0x0,<br /> sid = 0x2,<br /> length = 0x0,<br /> tag = 0xffff8880371cdb96<br /> }<br /> <br /> from the skb struct (trimmed)<br /> tail = 0x16,<br /> end = 0x140,<br /> head = 0xffff88803346f400 "4",<br /> data = 0xffff88803346f416 ":\377",<br /> truesize = 0x380,<br /> len = 0x0,<br /> data_len = 0x0,<br /> mac_len = 0xe,<br /> hdr_len = 0x0,<br /> <br /> it is not safe to access data[2].<br /> <br /> [pabeni@redhat.com: fixed subj typo]