CVE-2025-40240

Vulnerability

In the Linux kernel's SCTP implementation, a NULL pointer dereference occurs when chunk->skb is dereferenced in a code path where it is expected to be NULL. The root cause is that the check for a missing data buffer incorrectly uses chunk->skb instead of checking the frag_list. This flaw was introduced during a previous refactoring and can lead to a kernel crash when triggered [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted SCTP packets that cause the chunk data buffer to be missing. No authentication is required if the attacker can send packets to the target system. The vulnerability is reachable from the network if SCTP is enabled on the victim machine [2].

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). There is no indication of privilege escalation or remote code execution; the primary impact is availability [3].

Mitigation

The fix has been applied to the Linux kernel stable branches. Users should update to the latest patched kernel versions to remediate the vulnerability. No workaround is currently available [1][2][3].