In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7 cve-icon cve-icon
https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40 cve-icon cve-icon
https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430 cve-icon cve-icon
https://git.kernel.org/stable/c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7 cve-icon cve-icon
https://git.kernel.org/stable/c/ca18d751bcc9faf5b7e82e9fae1223d103928181 cve-icon cve-icon
https://git.kernel.org/stable/c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025090544-CVE-2025-39673-61bb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-39673 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-39673 cve-icon
History

Sun, 07 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux
Linux linux Kernel
Vendors & Products Linux
Linux linux
Linux linux Kernel

Sat, 06 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 05 Sep 2025 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.
Title ppp: fix race conditions in ppp_fill_forward_path
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-05T17:20:38.769Z

Updated: 2025-09-05T17:20:38.769Z

Reserved: 2025-04-16T07:20:57.112Z

Link: CVE-2025-39673

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-05T18:15:43.230

Modified: 2025-09-08T16:25:38.810

Link: CVE-2025-39673

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-05T00:00:00Z

Links: CVE-2025-39673 - Bugzilla