-

CVE-2025-39926

In the Linux kernel, the following vulnerability has been resolved:

genetlink: fix genl_bind() invoking bind() after -EPERM

Per family bind/unbind callbacks were introduced to allow families
to track multicast group consumer presence, e.g. to start or stop
producing events depending on listeners.

However, in genl_bind() the bind() callback was invoked even if
capability checks failed and ret was set to -EPERM. This means that
callbacks could run on behalf of unauthorized callers while the
syscall still returned failure to user space.

Fix this by only invoking bind() after "if (ret) break;" check
i.e. after permission checks have succeeded.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorLinux
Product Linux
Default Statusunaffected
Version < 98c9d884047a3051c203708914a874dece3cbe54
Version 3de21a8990d3c2cc507e9cc4ed00f36358d5b93e
Status affected
Version < 8858c1e9405906c09589d7c336f04058ea198207
Version 3de21a8990d3c2cc507e9cc4ed00f36358d5b93e
Status affected
Version < 1dbfb0363224f6da56f6655d596dc5097308d6f5
Version 3de21a8990d3c2cc507e9cc4ed00f36358d5b93e
Status affected
VendorLinux
Product Linux
Default Statusaffected
Version 6.9
Status affected
Version < 6.9
Version 0
Status unaffected
Version <= 6.12.*
Version 6.12.48
Status unaffected
Version <= 6.16.*
Version 6.16.8
Status unaffected
Version <= *
Version 6.17
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.044
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string