CVE-2025-23142: Linux Kernel Use-After-Free Vulnerability

CVE-2025-23142 Overview

CVE-2025-23142 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw resides in sctp_sendmsg() and its handling of transport references during message transmission. A race condition allows a local attacker to trigger the freeing of an SCTP transport that another thread has already selected for use, resulting in a use-after-free read in sctp_outq_select_transport().

The issue was identified by a private syzbot instance with a working C reproducer available in the upstream commit references.

Critical Impact
Local, low-privileged attackers can trigger a kernel use-after-free through SCTP socket operations, potentially leading to kernel memory corruption, information disclosure, or privilege escalation on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches, including 6.15-rc1)
Debian Linux 11.0 (LTS)
Distributions shipping unpatched SCTP-enabled kernels

Discovery Timeline

2025-05-01 - CVE-2025-23142 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2025-23142

Vulnerability Analysis

The sctp_sendmsg() function re-uses existing associations and transports by performing a lookup based on the socket endpoint and the message destination address. Once a transport is selected, sctp_sendmsg_to_asoc() assigns it to every chunk queued for transmission.

When the send buffer is full, the sender thread calls sctp_wait_for_sndbuf(), which temporarily releases the socket lock. During this window, a second thread can remove the selected transport, for example by calling setsockopt(SCTP_SOCKOPT_BINDX_REM) to unbind the address. When the sender resumes and the association outqueue is flushed, sctp_outq_select_transport() dereferences the freed transport structure, producing a use-after-free read.

Because the affected code runs in kernel context, exploitation can lead to memory disclosure, kernel panic, or privilege escalation depending on subsequent heap layout.

Root Cause

The root cause is missing lifetime validation for SCTP transports across a lock-release boundary. When sctp_wait_for_sndbuf() drops the socket lock, the sender thread has no mechanism to detect that its cached transport pointer has been freed. A prior cleanup, commit 47faa1e4c50e ("sctp: remove the dead field of sctp_transport"), removed the dead bit that historically flagged such freed transports.

Attack Vector

Exploitation requires local access and the ability to open SCTP sockets. An attacker races two threads on the same socket: one sends data large enough to fill the send buffer, and another unbinds the destination address using SCTP_SOCKOPT_BINDX_REM. The vulnerability manifests as a use-after-free read inside sctp_outq_select_transport(). A working C reproducer produced by syzbot is referenced in the upstream fix commit; refer to the Linux Kernel Commit for technical details.

Detection Methods for CVE-2025-23142

Indicators of Compromise

Kernel oops or KASAN reports referencing sctp_outq_select_transport or sctp_sendmsg_to_asoc
Unexpected kernel panics on hosts using SCTP-enabled workloads (telecom signaling, WebRTC data channels, clustering software)
Processes repeatedly invoking setsockopt with SCTP_SOCKOPT_BINDX_REM alongside concurrent sendmsg calls on the same socket

Detection Strategies

Enable KASAN or KFENCE on test kernels to surface use-after-free reads in the SCTP subsystem
Audit auditd and eBPF telemetry for unusual patterns of concurrent SCTP socket operations from unprivileged processes
Track loaded kernel modules and flag hosts where sctp is loaded but has no legitimate business use

Monitoring Recommendations

Aggregate dmesg and /var/log/kern.log output centrally and alert on SCTP-related stack traces
Monitor kernel version inventory and compare against the fixed commits published on git.kernel.org
Baseline SCTP socket usage per workload and alert on unexpected process trees invoking SCTP syscalls

How to Mitigate CVE-2025-23142

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories to all affected stable branches
Update Debian 11 packages to the fixed versions announced in the Debian LTS Announcement and the follow-up Debian LTS Announcement
On systems that do not require SCTP, blacklist the sctp kernel module to remove the attack surface

Patch Information

The fix restores the dead bit in struct sctp_transport, previously removed by commit 47faa1e4c50e. sctp_transport_free() now marks the transport as dead, and sctp_sendmsg_to_asoc() re-checks this flag after re-acquiring the socket lock while holding a reference to the transport. If deletion occurred, the function returns -EAGAIN so userspace can retry. Patches are available across multiple stable branches; see the primary Linux Kernel Commit and the backport series.

Workarounds

Disable SCTP by preventing module autoload: add install sctp /bin/true to /etc/modprobe.d/
Restrict SCTP socket creation to trusted service accounts using seccomp or SELinux policy
Limit local user access on multi-tenant hosts until kernels are patched

bash

# Blacklist the SCTP module to eliminate the attack surface
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true
lsmod | grep -i sctp