CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung
In the Linux kernel, the following vulnerability has been resolved:
net: ppp: Add bound checking for skb data on pppsynctxmung
Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets.
When pppsynctxmung receives an incoming package with an empty payload: (remote) gef➤ p (struct pppoehdr ) (skb->head + skb->networkheader) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 }
from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, datalen = 0x0, maclen = 0xe, hdrlen = 0x0,
it is not safe to access data[2].
[pabeni: fixed subj typo]
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: ppp: Add bound checking for skb data on pppsynctxmung
Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets.
When pppsynctxmung receives an incoming package with an empty payload: (remote) gef➤ p (struct pppoehdr ) (skb->head + skb->networkheader) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 }
from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, datalen = 0x0, maclen = 0xe, hdrlen = 0x0,
it is not safe to access data[2].
[pabeni@redhat.com: fixed subj typo]
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37749?
CVE-2025-37749 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-37749?
To fix CVE-2025-37749, update your Linux kernel to the latest stable version that includes the bound checking for skb data.
What systems are impacted by CVE-2025-37749?
CVE-2025-37749 affects the Linux kernel across various distributions that implement the affected networking component.
What types of attacks can exploit CVE-2025-37749?
CVE-2025-37749 could potentially be exploited to perform out-of-bounds access, leading to a denial of service or arbitrary code execution.
Is CVE-2025-37749 fixed in older kernel versions?
No, CVE-2025-37749 is not fixed in older kernel versions, and users are advised to upgrade to remediate the vulnerability.