CVE-2025-23143

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.

When I ran the repro [0] and waited a few seconds, I observed two

LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1]

Reproduction Steps:

1) Mount CIFS

2) Add an iptables rule to drop incoming FIN packets for CIFS

3) Unmount CIFS

4) Unload the CIFS module

5) Remove the iptables rule

At step 3), the CIFS module calls sock_release() for the underlying

TCP socket, and it returns quickly. However, the socket remains in

FIN_WAIT_1 because incoming FIN packets are dropped.

At this point, the module's refcnt is 0 while the socket is still

alive, so the following rmmod command succeeds.

# ss -tan

State Recv-Q Send-Q Local Address:Port Peer Address:Port

FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445

# lsmod | grep cifs

cifs 1159168 0

This highlights a discrepancy between t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References