CVE-2025-39848: ax25: properly unshare skbs in ax25_kiss_rcv()
Published Sep 19, 2025
·Updated
ax25: properly unshare skbs in ax25kissrcv()
Affected Software
21 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.96.2-2
Microsoft azl3 kernel 6.6.104.2-4
Linux Linux kernel>=2.6.12.1<5.4.299
Linux Linux kernel>=5.5<5.10.243
Linux Linux kernel>=5.11<5.15.192
Linux Linux kernel>=5.16<6.1.151
Linux Linux kernel>=6.2<6.6.105
Linux Linux kernel>=6.7<6.12.46
Linux Linux kernel>=6.13<6.16.6
Linux Linux kernel=2.6.12
Linux Linux kernel=2.6.12-rc2
Linux Linux kernel=2.6.12-rc3
Linux Linux kernel=2.6.12-rc4
Linux Linux kernel=2.6.12-rc5
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Linux Linux kernel=6.17-rc4
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Sep 19, 2025
CVE Published
via MITRE·03:26 PM
Data Sourced
via MITRE·03:26 PM
DescriptionSeverity
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 21, 2025
Data Sourced
via Microsoft·01:03 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-39848?
CVE-2025-39848 is classified as a medium severity vulnerability affecting the Linux kernel.
2
How do I fix CVE-2025-39848?
To resolve CVE-2025-39848, update your Linux kernel to the latest version where this issue has been patched.
3
What is the impact of CVE-2025-39848?
The impact of CVE-2025-39848 can lead to a system crash due to a NULL pointer dereference in the ax25_kiss_rcv() function.
4
Who reported the CVE-2025-39848 vulnerability?
CVE-2025-39848 was reported by security researcher Bernard Pidoux.
5
Which components are affected by CVE-2025-39848?
CVE-2025-39848 primarily affects the ax25 networking protocol implementation in the Linux kernel.