---
id: CVE-2025-39673
title: 'ppp: fix race conditions in ppp_fill_forward_path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ppp: fix race conditions in ppp_fill_forward_path

  ppp_fill_forward_path() has two race conditions:

  1. The ppp->channels list can change between list_empty() and
     li…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    0f1630be6fcca3f0c63e4b242ad202e5cde28a40
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    ca18d751bcc9faf5b7e82e9fae1223d103928181
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    94731cc551e29511d85aa8dec61a6c071b1f2430
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    f97f6475fdcb3c28ff3c55cc4b7bde632119ec08
  - >-
    Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 <
    0417adf367a0af11adf7ace849af4638cfb573f7
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:53:10.266228Z'
published: '2025-09-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:29.786Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39673'
references:
  - url: 'https://git.kernel.org/stable/c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7'
  - url: 'https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40'
  - url: 'https://git.kernel.org/stable/c/ca18d751bcc9faf5b7e82e9fae1223d103928181'
  - url: 'https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430'
  - url: 'https://git.kernel.org/stable/c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08'
  - url: 'https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7'
tags:
  - cve.org
epss: 0.00308
epssPercentile: 0.23496
ingestedAt: '2026-10-15T22:48:25.519Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix race conditions in ppp_fill_forward_path

ppp_fill_forward_path() has two race conditions:

1. The ppp->channels list can change between list_empty() and
   list_first_entry(), as ppp_lock() is not held. If the only channel
   is deleted in ppp_disconnect_channel(), list_first_entry() may
   access an empty head or a freed entry, and trigger a panic.

2. pch->chan can be NULL. When ppp_unregister_channel() is called,
   pch->chan is set to NULL before pch is removed from ppp->channels.

Fix these by using a lockless RCU approach:
- Use list_first_or_null_rcu() to safely test and access the first list
  entry.
- Convert list modifications on ppp->channels to their RCU variants and
  add synchronize_net() after removal.
- Check for a NULL pch->chan before dereferencing it.

## Affected

- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7`
- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0f1630be6fcca3f0c63e4b242ad202e5cde28a40`
- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < ca18d751bcc9faf5b7e82e9fae1223d103928181`
- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 94731cc551e29511d85aa8dec61a6c071b1f2430`
- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < f97f6475fdcb3c28ff3c55cc4b7bde632119ec08`
- `Linux >= f6efc675c9dd8d93f826b79ae7e33e03301db609 < 0417adf367a0af11adf7ace849af4638cfb573f7`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.