PT-2025-27956 · Linux+6 · Linux Kernel+6
Published
2025-06-17
·
Updated
2026-04-20
·
CVE-2025-38181
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to the fixed version
Description:
A null pointer dereference issue was found in the Linux kernel, specifically in the calipso req {set,del}attr() functions. This issue can be triggered when the SYN Cookie feature is used, causing a null pointer dereference in the sock omalloc() function. The problem arises when the rsk listener is NULL, which can occur when the SYN Cookie is returned to its client. The estimated number of potentially affected devices is not provided.
Recommendations:
To resolve this issue, return an error in calipso req setattr() and calipso req delattr() when the SYN Cookie case is encountered. As a temporary workaround, consider disabling the SYN Cookie feature for CALIPSO until a patch is available.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu