CVE-2025-39673Critical· 9.8▾ Midnight

ppp: fix race conditions in ppp_fill_forward_path

In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and li…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 5, 2025

Updated

Oct 15, 2026

CVSS

9.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

54 · Moderate

EPSS

0.31% · p23

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-15

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 15.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 405 days

Sep 5, 2025Published
Disclosed via CVEORG
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026EPSS first tracked
0.3%

Linux #cve.org

Affected

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0f1630be6fcca3f0c63e4b242ad202e5cde28a40
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < ca18d751bcc9faf5b7e82e9fae1223d103928181
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 94731cc551e29511d85aa8dec61a6c071b1f2430
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < f97f6475fdcb3c28ff3c55cc4b7bde632119ec08
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0417adf367a0af11adf7ace849af4638cfb573f7
Linux 5.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix race conditions in ppp_fill_forward_path

ppp_fill_forward_path() has two race conditions:

The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic.
pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels.

Fix these by using a lockless RCU approach:

Use list_first_or_null_rcu() to safely test and access the first list entry.
Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal.
Check for a NULL pch->chan before dereferencing it.

Affected

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0f1630be6fcca3f0c63e4b242ad202e5cde28a40
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < ca18d751bcc9faf5b7e82e9fae1223d103928181
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 94731cc551e29511d85aa8dec61a6c071b1f2430
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < f97f6475fdcb3c28ff3c55cc4b7bde632119ec08
Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0417adf367a0af11adf7ace849af4638cfb573f7
Linux 5.13

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

ppp: fix race conditions in ppp_fill_forward_path

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix race conditions in ppp_fill_forward_path

ppp_fill_forward_path() has two race conditions:

The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic.

pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels.

Fix these by using a lockless RCU approach:

Use list_first_or_null_rcu() to safely test and access the first list entry.

Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal.

Check for a NULL pch->chan before dereferencing it.

Affected

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0f1630be6fcca3f0c63e4b242ad202e5cde28a40

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < ca18d751bcc9faf5b7e82e9fae1223d103928181

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 94731cc551e29511d85aa8dec61a6c071b1f2430

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < f97f6475fdcb3c28ff3c55cc4b7bde632119ec08

Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0417adf367a0af11adf7ace849af4638cfb573f7

Linux 5.13