LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22062: sctp: add mutual exclusion in proc_sctp_do_udp_port()

In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653 Call Trace: <TASK> udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181 sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930 proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553 proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601 iter_file_splice_write+0x91c/0x1150 fs/splice.c:738 do_splice_from fs/splice.c:935 [inline] direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158 splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102 do_splice_direct_actor fs/splice.c:1201 [inline] do_splice_direct+0x174/0x240 fs/splice.c:1227 do_sendfile+0xafd/0xe50 fs/read_write.c:1368 __do_sys_sendfile64 fs/read_write.c:1429 [inline] __se_sys_sendfile64 fs/read_write.c:1415 [inline] __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in the Linux kernel’s SCTP-over-UDP configuration handling can cause a kernel crash when socket stop and start operations overlap. Exploitation requires local, low-privileged access according to the supplied CVSS vector, so ordinary internet exposure alone is not sufficient. Successful abuse could disrupt the entire affected host.

Executive priority

Treat as a high-priority operating-system update for affected multi-user or locally shared Linux systems. It is not evidenced as remotely exploitable or actively exploited, so prioritize by local-user exposure and business impact rather than internet presence alone.

Technical view

Concurrent calls through proc_sctp_do_udp_port() were not serialized, allowing sctp_udp_sock_stop() and sctp_udp_sock_start() to race. The supplied syzbot trace shows a null-pointer dereference during kernel_sock_shutdown(), producing a kernel fault. Linux stable commits add mutual exclusion around the affected operations.

Likely exposure

Exposure is most relevant on affected Linux hosts where a local low-privileged user can reach the vulnerable SCTP configuration path. Multi-user systems therefore deserve particular attention. The supplied affected-version data contains ambiguous entries, so determine exposure through distribution guidance and fix-commit inclusion rather than version numbers alone.

Exploitation context

The supplied record reports a syzbot-discovered kernel crash. It does not establish malicious exploitation, and KEV is false. The CVSS 3.1 vector scores it 7.8 with local access, low complexity, low privileges, no user interaction, and potentially severe host impact.

Researcher notes

The demonstrated outcome is a KASAN-detected null-pointer dereference caused by missing serialization in the SCTP UDP-port sysctl path. Stable fixes are referenced for multiple kernel branches. The bundled version list appears flattened or incomplete, preventing a reliable affected-range reconstruction without additional vendor mapping.

Mitigation direction

  • Install a supported vendor kernel update containing the applicable Linux stable fix.
  • Prioritize multi-user hosts where untrusted local accounts may access SCTP configuration.
  • Follow distribution guidance when mapped package versions differ from upstream kernel versions.
  • Restrict untrusted local access until affected systems can be updated.

Validation and detection

  • Inventory running kernel and distribution package versions across Linux hosts.
  • Determine whether the relevant stable fix is included in each deployed kernel package.
  • Review SCTP availability and operational use on potentially affected hosts.
  • After updating, verify systems booted into the remediated kernel.
  • Monitor kernel logs for SCTP-related faults or unexpected host crashes.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22062 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-22062Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8, 046c052b475e7119b6a30e3483e2888fc606a2f8unaffected
LinuxLinux5.11, 0, 5.15.184, 6.1.140, 6.6.92, 6.12.23, 6.13.11, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.