CVE-2025-21638

Q: What is the severity of CVE-2025-21638?

CVE-2025-21638 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's SCTP implementation allows local attackers to cause a kernel panic (denial of service) by triggering a race condition during process exit. This affects Linux systems with SCTP enabled and requires local access to exploit. The vulnerability occurs when accessing current->nsproxy which can be NULL during task exit.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's SCTP implementation allows local attackers to cause a kernel panic (denial of service) by triggering a race condition during process exit. This affects Linux systems with SCTP enabled and requires local access to exploit. The vulnerability occurs when accessing current->nsproxy which can be NULL during task exit.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not specified in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when SCTP (Stream Control Transmission Protocol) is enabled. Many distributions disable SCTP by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

Local denial of service through kernel panic, requiring system reboot to recover.

🟢

If Mitigated

Minimal impact with proper access controls limiting local user privileges.

🌐 Internet-Facing: LOW - Requires local access, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could cause system crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger race condition during process exit. Discovered by syzbot fuzzer.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 15649fd5415eda664ef35780c2013adeb5d9c695, 1b67030d39f2b00f94ac1f0af11ba6657589e4d3, 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6, bd2a2939423566c654545fa3e96a656662a0af9e, c184bc621e3cef03ac9ba81a50dda2dae6a21d36

Vendor Advisory: https://git.kernel.org/stable/c/15649fd5415eda664ef35780c2013adeb5d9c695

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable SCTP module

linux

Prevent loading of SCTP kernel module to eliminate attack surface

echo 'install sctp /bin/true' >> /etc/modprobe.d/disable-sctp.conf
rmmod sctp

Blacklist SCTP module

linux

Prevent SCTP module from being loaded at boot

echo 'blacklist sctp' >> /etc/modprobe.d/blacklist-sctp.conf

🧯 If You Can't Patch

Restrict local user access and implement least privilege principles
Monitor for kernel panic events and implement system health monitoring

🔍 How to Verify

Check if Vulnerable:

Check if SCTP module is loaded: lsmod | grep sctp. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version. Confirm SCTP module still functions if required.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
NULL pointer dereference errors in kernel logs
System crash/reboot events

Network Indicators:

None - local exploitation only

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "kernel panic" OR "Oops") AND "sctp"

📊 Metadata

CVE ID: CVE-2025-21638

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.05% exploit probability (16.6th percentile)

Published: January 19, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable SCTP module

Blacklist SCTP module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities