NULL Pointer Dereference Vulnerability in Linux Kernel TCP-AO Feature

CVE-2025-39950

What is CVE-2025-39950?

A vulnerability in the Linux kernel's TCP-AO implementation allows for a NULL pointer dereference during the connect() system call on sockets that have the TCP-AO key added and TCP_REPAIR enabled. If an invalid state occurs, the function tcp_ao_finish_connect can attempt to dereference a NULL pointer, leading to unexpected behavior and potential kernel crashes. The proposed fix ensures that before dereferencing the skb variable, a validation check is performed to prevent this fault. This issue emphasizes the necessity for robust error handling within kernel networking code.

References