CVE-2025-23142

Kernel memory access via SCTP transport race

Published May 1, 2025 · Updated Aug 5, 2026

Use-after-free in Linux kernel SCTP allows local users to access freed transport data by racing message sending with address removal. SCTP sendmsg binds a selected transport to queued chunks, then sctp_wait_for_sndbuf releases the socket lock while a full send buffer waits, allowing another thread to free that transport before sctp_outq_select_transport reads it. The gate requires a low-privileged local process, concurrent sends and address unbinding, and a full SCTP send buffer.

CVSS severity7.8
High
EPSS probability0.21%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Use-after-free in Linux kernel SCTP allows local users to access freed transport data by racing message sending with address removal. SCTP sendmsg binds a selected transport to queued chunks, then sctp_wait_for_sndbuf releases the socket lock while a full send buffer waits, allowing another thread to free that transport before sctp_outq_select_transport reads it. The gate requires a low-privileged local process, concurrent sends and address unbinding, and a full SCTP send buffer.

The record

CVE
CVE-2025-23142
Published
May 1, 2025
Updated
Aug 5, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
CWE-416
Attack vector
local
Privileges
Unavailable

Timeline

How it unfolded

  1. May 1, 2025CVE publishedPublication date reported by the CVE source.
  2. Aug 5, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=26e51e5287eed4d96ea66a3da95429f42940f013
  2. Affected versionversion=3.18.128 <3.19
  3. Affected versionversion=4.14.85 <4.15
  4. Affected versionversion=4.19.6 <4.20
  5. Affected versionversion=4.20
  6. Affected versionversion=4.4.166 <4.5
  7. Affected versionversion=4.9.142 <4.10
  8. Affected versionversion=8376fdc999be008f0e9918db52f1ed8c08f5a1c9
  9. Affected versionversion=8b97e045bd6d37f96f161e4d371ae174148e1587
  10. Affected versionversion=cd947138e8c31e8cfcd489c12e9b97271beb6e79
  11. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <0f7df4899299ce4662e5f95badb9dbc57cc37fa5
  12. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <2e5068b7e0ae0a54f6cfd03a2f80977da657f1ee
  13. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <3257386be6a7eb8a8bfc9cbfb746df4eb4fc70e8
  14. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <547762250220325d350d0917a7231480e0f4142b
  15. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <5bc83bdf5f5b8010d1ca5a4555537e62413ab4e2
  16. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <7a63f4fb0efb4e69efd990cbb740a848679ec4b0
  17. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <9e7c37fadb3be1fc33073fcf10aa96d166caa697
  18. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <c6fefcb71d246baaf3bacdad1af7ff50ebcfe652
  19. Affected versionversion=df132eff463873e14e019a07f387b4d577d6d1f9 <f1a69a940de58b16e8249dff26f74c8cc59b32be
  20. Affected versionversion=e044554e97e812eb257d073bcc130e0ea653858f

What conditions does exploitation require?

Attack vectorlocal
Required privilegesUnavailable in this record.

What is affected?

The Linux Kernel Organization · Linuxversion=26e51e5287eed4d96ea66a3da95429f42940f013; version=3.18.128 <3.19; version=4.14.85 <4.15; version=4.19.6 <4.20; version=4.20; version=4.4.166 <4.5; version=4.9.142 <4.10; version=8376fdc999be008f0e9918db52f1ed8c08f5a1c9; version=8b97e045bd6d37f96f161e4d371ae174148e1587; version=cd947138e8c31e8cfcd489c12e9b97271beb6e79; version=df132eff463873e14e019a07f387b4d577d6d1f9 <0f7df4899299ce4662e5f95badb9dbc57cc37fa5; version=df132eff463873e14e019a07f387b4d577d6d1f9 <2e5068b7e0ae0a54f6cfd03a2f80977da657f1ee; version=df132eff463873e14e019a07f387b4d577d6d1f9 <3257386be6a7eb8a8bfc9cbfb746df4eb4fc70e8; version=df132eff463873e14e019a07f387b4d577d6d1f9 <547762250220325d350d0917a7231480e0f4142b; version=df132eff463873e14e019a07f387b4d577d6d1f9 <5bc83bdf5f5b8010d1ca5a4555537e62413ab4e2; version=df132eff463873e14e019a07f387b4d577d6d1f9 <7a63f4fb0efb4e69efd990cbb740a848679ec4b0; version=df132eff463873e14e019a07f387b4d577d6d1f9 <9e7c37fadb3be1fc33073fcf10aa96d166caa697; version=df132eff463873e14e019a07f387b4d577d6d1f9 <c6fefcb71d246baaf3bacdad1af7ff50ebcfe652; version=df132eff463873e14e019a07f387b4d577d6d1f9 <f1a69a940de58b16e8249dff26f74c8cc59b32be; version=e044554e97e812eb257d073bcc130e0ea653858f

Published CVSS scores

7.8NIST NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8kernel.orgCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
PrivilegesUnavailable
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-416Use After Free

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo