CVE-2025-39847: ppp: fix memory leak in pad_compress_skb
In the Linux kernel, the following vulnerability has been resolved:
ppp: fix memory leak in padcompressskb
If allocskb() fails in padcompressskb(), it returns NULL without releasing the old skb. The caller does:
skb = padcompressskb(ppp, skb); if (!skb) goto drop;
drop: kfreeskb(skb);
When padcompressskb() returns NULL, the reference to the old skb is lost and kfreeskb(skb) ends up doing nothing, leading to a memory leak.
Align padcompressskb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the newskb variable so the original skb is not lost when padcompressskb() fails.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39847?
CVE-2025-39847 has a low severity rating due to the memory leak it introduces.
How do I fix CVE-2025-39847?
To fix CVE-2025-39847, you should update your Linux kernel to the latest patched version.
What components are affected by CVE-2025-39847?
CVE-2025-39847 affects the Linux kernel specifically in the ppp module.
What is the impact of CVE-2025-39847?
The impact of CVE-2025-39847 is a potential memory leak which could lead to increased memory usage over time.
Who is responsible for addressing CVE-2025-39847?
The Linux kernel development team is responsible for addressing CVE-2025-39847 through updates and patches.