CVE-2025-39852

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6

When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just

exits the function. This ends up causing a memory-leak:

unreferenced object 0xffff0000281a8200 (size 2496):

comm "softirq", pid 0, jiffies 4295174684

hex dump (first 32 bytes):

7f 00 00 06 7f 00 00 06 00 00 00 00 cb a8 88 13 ................

0a 00 03 61 00 00 00 00 00 00 00 00 00 00 00 00 ...a............

backtrace (crc 5ebdbe15):

kmemleak_alloc+0x44/0xe0

kmem_cache_alloc_noprof+0x248/0x470

sk_prot_alloc+0x48/0x120

sk_clone_lock+0x38/0x3b0

inet_csk_clone_lock+0x34/0x150

tcp_create_openreq_child+0x3c/0x4a8

tcp_v6_syn_recv_sock+0x1c0/0x620

tcp_check_req+0x588/0x790

tcp_v6_rcv+0x5d0/0xc18

ip6_protocol_deliver_rcu+0x2d8/0x4c0

ip6_input_finish+0x74/0x148

ip6_input+0x50/0x118

ip6_sublist_rcv+0x2fc/0x3b0

ipv6_list_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References