CVE-2025-38465

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38465
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc."). For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc. Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int. Before: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port -1668710080 0 rtnl:nl_wraparound/293 * After: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4b8e18af7bea92f8b7fb92d40aeae729209db250 Patch
https://git.kernel.org/stable/c/55baecb9eb90238f60a8350660d6762046ebd3bd Patch
https://git.kernel.org/stable/c/76602d8e13864524382b0687dc32cd8f19164d5a Patch
https://git.kernel.org/stable/c/9da025150b7c14a8390fc06aea314c0a4011e82c Patch
https://git.kernel.org/stable/c/ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc Patch
https://git.kernel.org/stable/c/c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98 Patch
https://git.kernel.org/stable/c/cd7ff61bfffd7000143c42bbffb85eeb792466d6 Patch
https://git.kernel.org/stable/c/fd69af06101090eaa60b3d216ae715f9c0a58e5b Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

22 Dec 2025, 19:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/4b8e18af7bea92f8b7fb92d40aeae729209db250 - () https://git.kernel.org/stable/c/4b8e18af7bea92f8b7fb92d40aeae729209db250 - Patch
References () https://git.kernel.org/stable/c/55baecb9eb90238f60a8350660d6762046ebd3bd - () https://git.kernel.org/stable/c/55baecb9eb90238f60a8350660d6762046ebd3bd - Patch
References () https://git.kernel.org/stable/c/76602d8e13864524382b0687dc32cd8f19164d5a - () https://git.kernel.org/stable/c/76602d8e13864524382b0687dc32cd8f19164d5a - Patch
References () https://git.kernel.org/stable/c/9da025150b7c14a8390fc06aea314c0a4011e82c - () https://git.kernel.org/stable/c/9da025150b7c14a8390fc06aea314c0a4011e82c - Patch
References () https://git.kernel.org/stable/c/ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc - () https://git.kernel.org/stable/c/ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc - Patch
References () https://git.kernel.org/stable/c/c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98 - () https://git.kernel.org/stable/c/c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98 - Patch
References () https://git.kernel.org/stable/c/cd7ff61bfffd7000143c42bbffb85eeb792466d6 - () https://git.kernel.org/stable/c/cd7ff61bfffd7000143c42bbffb85eeb792466d6 - Patch
References () https://git.kernel.org/stable/c/fd69af06101090eaa60b3d216ae715f9c0a58e5b - () https://git.kernel.org/stable/c/fd69af06101090eaa60b3d216ae715f9c0a58e5b - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netlink: Se corrigen los wraparounds de sk->sk_rmem_alloc. Netlink presenta este patrón en algunos lugares if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , que presenta el mismo problema corregido por el commit 5a465a0da13e ("udp: Se corrigen múltiples wraparounds de sk->sk_rmem_alloc."). Por ejemplo, si establecemos INT_MAX en SO_RCVBUFFORCE, la condición siempre es falsa, ya que los dos operandos son de tipo int. En ese caso, un solo socket puede consumir tantos skb como sea posible hasta que se produzca un OOM, y podemos observar múltiples wraparounds de sk->sk_rmem_alloc. Para solucionarlo, usemos atomic_add_return() y comparemos las dos variables como enteros sin signo. Antes: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Dirección local: Puerto Dirección del par: Puerto -1668710080 0 rtnl:nl_wraparound/293 * Después: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Dirección local: Puerto Dirección del par: Puerto 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576

25 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 16:15

Updated : 2025-12-22 19:36

NVD link : CVE-2025-38465

Mitre link : CVE-2025-38465

CVE.ORG link : CVE-2025-38465

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime