CVE-2025-39673
A critical race condition in the Linux kernel’s PPP module can cause a system crash. The flaw allows an attacker to trigger a panic by manipulating PPP channels. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 6.17 and earlier, and Debian Linux 11.0. Typical users are system administrators, servers, and embedded devices that run these kernels.
Real-world impact
An attacker could cause a denial of service by crashing the system, potentially disrupting services and requiring a reboot.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network without authentication, can be triggered with no user interaction, and leads to complete loss of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to version 6.17 or later.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Sep 5, 2025 · Sep 5, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6h agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 2h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/0417adf367a0af11ad…patch
- git.kernel.org/stable/c/0f1630be6fcca3f0c6…patch
- git.kernel.org/stable/c/94731cc551e29511d8…patch
- git.kernel.org/stable/c/9a1969fbffc1f1900d…patch
- git.kernel.org/stable/c/ca18d751bcc9faf5b7…patch
- git.kernel.org/stable/c/f97f6475fdcb3c28ff…patch
- lists.debian.org/debian-lts-announce/2025/10…third party advisory
- cert-portal.siemens.com/productcert/html/ssa-032379…