CVE-2025-39848

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ax25: properly unshare skbs in ax25_kiss_rcv()<br /> <br /> Bernard Pidoux reported a regression apparently caused by commit<br /> c353e8983e0d ("net: introduce per netns packet chains").<br /> <br /> skb-&gt;dev becomes NULL and we crash in __netif_receive_skb_core().<br /> <br /> Before above commit, different kind of bugs or corruptions could happen<br /> without a major crash.<br /> <br /> But the root cause is that ax25_kiss_rcv() can queue/mangle input skb<br /> without checking if this skb is shared or not.<br /> <br /> Many thanks to Bernard Pidoux for his help, diagnosis and tests.<br /> <br /> We had a similar issue years ago fixed with commit 7aaed57c5c28<br /> ("phonet: properly unshare skbs in phonet_rcv()").