VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Sep 19, 2025· Updated May 12, 2026

CVE-2025-39848

CVE-2025-39848

Description

In the Linux kernel, the following vulnerability has been resolved:

ax25: properly unshare skbs in ax25_kiss_rcv()

Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

122

Patches

Vulnerability mechanics

References

11

News mentions

1