---
id: CVE-2025-39847
title: 'ppp: fix memory leak in pad_compress_skb'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ppp: fix memory leak in pad_compress_skb

  If alloc_skb() fails in pad_compress_skb(), it returns NULL without
  releasing the old skb. The caller does:

      skb = pad_com…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    9ca6a040f76c0b149293e430dabab446f3fc8ab7
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    87a35a36742df328d0badf4fbc2e56061c15846c
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    0b21e9cd4559102da798bdcba453b64ecd7be7ee
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    85c1c86a67e09143aa464e9bf09c397816772348
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    631fc8ab5beb9e0ec8651fb9875b9a968e7b4ae4
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    33a5bac5f14772730d2caf632ae97b6c2ee95044
  - >-
    Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c <
    4844123fe0b853a4982c02666cb3fd863d701d50
  - Linux 2.6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:12:34.406594Z'
published: '2025-09-19'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:13:00.053Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39847'
references:
  - url: 'https://git.kernel.org/stable/c/9ca6a040f76c0b149293e430dabab446f3fc8ab7'
  - url: 'https://git.kernel.org/stable/c/87a35a36742df328d0badf4fbc2e56061c15846c'
  - url: 'https://git.kernel.org/stable/c/0b21e9cd4559102da798bdcba453b64ecd7be7ee'
  - url: 'https://git.kernel.org/stable/c/1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8'
  - url: 'https://git.kernel.org/stable/c/85c1c86a67e09143aa464e9bf09c397816772348'
  - url: 'https://git.kernel.org/stable/c/631fc8ab5beb9e0ec8651fb9875b9a968e7b4ae4'
  - url: 'https://git.kernel.org/stable/c/33a5bac5f14772730d2caf632ae97b6c2ee95044'
  - url: 'https://git.kernel.org/stable/c/4844123fe0b853a4982c02666cb3fd863d701d50'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05619
ingestedAt: '2026-11-05T22:38:32.034Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix memory leak in pad_compress_skb

If alloc_skb() fails in pad_compress_skb(), it returns NULL without
releasing the old skb. The caller does:

    skb = pad_compress_skb(ppp, skb);
    if (!skb)
        goto drop;

drop:
    kfree_skb(skb);

When pad_compress_skb() returns NULL, the reference to the old skb is
lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.

Align pad_compress_skb() semantics with realloc(): only free the old
skb if allocation and compression succeed.  At the call site, use the
new_skb variable so the original skb is not lost when pad_compress_skb()
fails.

## Affected

- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 9ca6a040f76c0b149293e430dabab446f3fc8ab7`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 87a35a36742df328d0badf4fbc2e56061c15846c`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 0b21e9cd4559102da798bdcba453b64ecd7be7ee`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 85c1c86a67e09143aa464e9bf09c397816772348`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 631fc8ab5beb9e0ec8651fb9875b9a968e7b4ae4`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 33a5bac5f14772730d2caf632ae97b6c2ee95044`
- `Linux >= b3f9b92a6ec1a9a5e4b4b36e484f2f62cc73277c < 4844123fe0b853a4982c02666cb3fd863d701d50`
- `Linux 2.6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.