CVE-2025-21642

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: sysctl: sched: avoid using current->nsproxy

Using the 'net' structure via 'current' is not recommended for different

reasons.

First, if the goal is to use it to read or write per-netns data, this is

inconsistent with how the "generic" sysctl entries are doing: directly

by only using pointers set to the table entry, e.g. table->data. Linked

to that, the per-netns data should always be obtained from the table

linked to the netns it had been created for, which may not coincide with

the reader's or writer's netns.

Another reason is that access to current->nsproxy->netns can oops if

attempted when current->nsproxy had been dropped when the current task

is exiting. This is what syzbot found, when using acct(2):

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]

CPU: 1 UI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References