CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid NULL dereference when chunk data buffer is missing
chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only.
chunk->skb can only be NULL if chunk->headskb is not. Check for fraglist instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid NULL dereference when chunk data buffer is missing
chunk-skb pointer is dereferenced in the if-block where it's supposed to be NULL only.
chunk-skb can only be NULL if chunk-headskb is not. Check for fraglist instead and do it just before replacing chunk-skb. We're sure that otherwise chunk-skb is non-NULL because of outer if() condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40240?
CVE-2025-40240 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-40240?
To resolve CVE-2025-40240, update your Linux kernel to the latest version that includes the fix for this vulnerability.
What systems are affected by CVE-2025-40240?
CVE-2025-40240 affects various versions of the Linux kernel that implement the SCTP protocol.
What type of vulnerability is CVE-2025-40240?
CVE-2025-40240 is a NULL pointer dereference vulnerability in the SCTP implementation of the Linux kernel.
What can attackers do with CVE-2025-40240?
An attacker could potentially exploit CVE-2025-40240 to cause a denial of service by causing the system to crash.