CVE-2025-38165
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.1.54 (inc) to 6.1.142 (exc) |
| linux | linux_kernel | From 6.5.4 (inc) to 6.6.94 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.34 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.3 (exc) |
| linux | linux_kernel | 5.15.189 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a kernel panic in the Linux kernel related to the bpf sockmap feature when calling skb_linearize. It occurs due to a race condition introduced by a previous fix that moved skb_get() to avoid races but caused a panic when skb_linearize is executed. The panic happens because skb_linearize asserts that the skb is not shared, but the skb_get placement caused this assertion to fail, leading to a kernel BUG. The issue is triggered by processing large payloads (e.g., 100KB) that exceed MAX_MSG_FRAGS, causing skb_linearize to be called improperly. The fix involves moving skb_get into the sk_psock_skb_ingress_enqueue function to prevent the panic.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic, which leads to a system crash and potential denial of service. Systems using the affected Linux kernel with bpf sockmap functionality could become unstable or unresponsive when processing certain network traffic patterns, especially large payloads that trigger the skb_linearize panic. This can disrupt services and require a system reboot to recover.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the kernel panic using the provided command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000. Observing a kernel panic with messages similar to 'kernel BUG at net/core/skbuff.c:2178!' indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves moving the skb_get call into sk_psock_skb_ingress_enqueue to prevent the panic caused by skb_linearize. Until the update is applied, avoid triggering conditions such as using the strparser module with large payloads (e.g., --rx-strp 100000) that cause skb_linearize to be executed.