CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path
In the Linux kernel, the following vulnerability has been resolved:
ppp: fix race conditions in pppfillforwardpath
pppfillforwardpath() has two race conditions:
1. The ppp->channels list can change between listempty() and listfirstentry(), as ppplock() is not held. If the only channel is deleted in pppdisconnectchannel(), listfirstentry() may access an empty head or a freed entry, and trigger a panic.
2. pch->chan can be NULL. When pppunregisterchannel() is called, pch->chan is set to NULL before pch is removed from ppp->channels.
Fix these by using a lockless RCU approach: - Use listfirstornullrcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronizenet() after removal. - Check for a NULL pch->chan before dereferencing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a NULL check for pch->chan before dereferencing it in the affected PPP forward-path/channel code paths.
Linux kernel PPP (ppp_fill_forward_path / ppp_unregister_channel / ppp_disconnect_channel) NULL-check pch->chan before dereference = if (pch->chan == NULL) handle safely without dereferencing - Configuration
Fix the race by converting ppp->channels list modifications to their RCU variants and use list_first_or_null_rcu() for safely testing/accessing the first list entry (avoid list_empty()/list_first_entry() races when ppp_lock() is not held).
Linux kernel PPP (ppp->channels list handling) Use RCU variants for ppp->channels list modifications and access = use lockless RCU list operations; replace list modifications with their RCU variants and access using list_first_or_null_rcu() - Configuration
When ppp_unregister_channel() removes the channel from ppp->channels, add synchronize_net() after the removal to ensure readers using RCU do not access freed entries/panic.
Linux kernel PPP (ppp_unregister_channel) RCU grace period after removal = call synchronize_net() after removal
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39673?
CVE-2025-39673 is considered a medium severity vulnerability due to potential race conditions in the ppp_fill_forward_path function in the Linux kernel.
How do I fix CVE-2025-39673?
To mitigate CVE-2025-39673, it is recommended to update the Linux kernel to the latest version that includes the fix for this vulnerability.
What is the impact of CVE-2025-39673?
The impact of CVE-2025-39673 includes the possibility of race conditions which could potentially lead to unpredictable behavior in networking functionalities.
Which systems are affected by CVE-2025-39673?
CVE-2025-39673 affects versions of the Linux kernel that include the ppp subsystem.
What is the primary vulnerability in CVE-2025-39673?
The primary vulnerability in CVE-2025-39673 involves race conditions occurring in the ppp_fill_forward_path function due to improper locking.