CVE-2025-39847

In the Linux kernel, the following vulnerability has been resolved:

ppp: fix memory leak in pad_compress_skb

If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does:

skb = pad_compress_skb(ppp, skb);
if (!skb)
    goto drop;

drop: kfree_skb(skb);

When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.

Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.

A memory leak in PPP’s pad_compress_skb() could occur when alloc_skb() fails: the function returned NULL while the original skb reference was lost by the caller, leaking memory. The fix aligns the function with realloc semantics (only free on success) and updates the caller to use a temporary new_skb, preventing reference loss. Practically, impact is limited to availability on systems using PPP compression (e.g., MPPE) under allocation/pressure failures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.