Mutual Exclusion Vulnerability in Linux Kernel's SCTP UDP Port Handling
Summary
CVE-2025-22062: In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbo... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports various networking protocols, including SCTP (Stream Control Transmission Protocol), which is crucial for reliable message delivery. The vulnerability in question arises from improper handling of UDP port operations within the SCTP module, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability exists due to a lack of mutual exclusion in the functions handling UDP port operations for SCTP. This oversight can lead to race conditions, where simultaneous calls to start and stop the SCTP UDP socket can cause a crash. The specific error reported involves a general protection fault, indicating that the system attempted to access a non-canonical address, which can destabilize the kernel and affect system reliability.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid making simultaneous calls to the SCTP UDP socket start and stop functions. This can be achieved by implementing proper synchronization in the application code that interacts with these functions, ensuring that only one operation is executed at a time.
Conclusion
The vulnerability identified in the Linux kernel's SCTP UDP port handling poses significant risks, including system crashes. Users are advised to update their systems promptly to the latest patched version to ensure stability and security. Temporary workarounds can be implemented while awaiting updates.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes, causing potential downtime and loss of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
Yes, a patch has been released. Users should update their Linux kernel to the latest version to mitigate this issue.
Implementing proper synchronization in your application code to avoid simultaneous calls to the SCTP UDP socket functions can serve as a temporary workaround.
Detailed information can be found in the CVE database and through the Linux kernel's official release notes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
