In the Linux kernel, the following vulnerability has been resolved:
ppp: fix memory leak in pad_compress_skb
If alloc_skb() fails in pad_compress_skb(), it returns NULL without
releasing the old skb. The caller does:
skb = pad_compress_skb(ppp, skb);
if (!skb)
goto drop;
drop:
kfree_skb(skb);
When pad_compress_skb() returns NULL, the reference to the old skb is
lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.
Align pad_compress_skb() semantics with realloc(): only free the old
skb if allocation and compression succeed. At the call site, use the
new_skb variable so the original skb is not lost when pad_compress_skb()
fails.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
20 Jan 2026, 15:20
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Debian Debian debian Linux Linux linux Kernel |
|
| CWE | CWE-401 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/0b21e9cd4559102da798bdcba453b64ecd7be7ee - Patch | |
| References | () https://git.kernel.org/stable/c/1d8b354eafb8876d8bdb1bef69c7d2438aacfbe8 - Patch | |
| References | () https://git.kernel.org/stable/c/33a5bac5f14772730d2caf632ae97b6c2ee95044 - Patch | |
| References | () https://git.kernel.org/stable/c/4844123fe0b853a4982c02666cb3fd863d701d50 - Patch | |
| References | () https://git.kernel.org/stable/c/631fc8ab5beb9e0ec8651fb9875b9a968e7b4ae4 - Patch | |
| References | () https://git.kernel.org/stable/c/85c1c86a67e09143aa464e9bf09c397816772348 - Patch | |
| References | () https://git.kernel.org/stable/c/87a35a36742df328d0badf4fbc2e56061c15846c - Patch | |
| References | () https://git.kernel.org/stable/c/9ca6a040f76c0b149293e430dabab446f3fc8ab7 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory, Mailing List | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Sep 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-19 16:15
Updated : 2026-01-20 15:20
NVD link : CVE-2025-39847
Mitre link : CVE-2025-39847
CVE.ORG link : CVE-2025-39847
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime