SB2025121003 - Out-of-bounds read in Linux kernel sctp
Published: December 10, 2025
Security Bulletin ID
SB2025121003
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2025-40331)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the inet_diag_msg_sctpladdrs_fill() function in net/sctp/diag.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2fe08fcaacb7eb019fa9c81db39b2214de216677
- https://git.kernel.org/stable/c/3006959371007fc2eae4a078f823c680fa52de1a
- https://git.kernel.org/stable/c/584307275b2048991b2e8984962189b6cc0a9b85
- https://git.kernel.org/stable/c/72e3fea68eac8d088e44c3dd954e843478e9240e
- https://git.kernel.org/stable/c/89eac1e150dbd42963e13d23828cb8c4e0763196
- https://git.kernel.org/stable/c/95aef86ab231f047bb8085c70666059b58f53c09
- https://git.kernel.org/stable/c/b106a68df0650b694b254427cd9250c04500edd3
- https://git.kernel.org/stable/c/c9119f243d9c0da3c3b5f577a328de3e7ffd1b42