CVE-2025-38165 (GCVE-0-2025-38165)
Vulnerability from cvelistv5
Published
2025-07-03 08:36
Modified
2025-07-28 04:13
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling skb_linearize The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Then a kernel panic was captured: ''' [ 657.460555] kernel BUG at net/core/skbuff.c:2178! [ 657.462680] Tainted: [W]=WARN [ 657.463287] Workqueue: events sk_psock_backlog ... [ 657.469610] <TASK> [ 657.469738] ? die+0x36/0x90 [ 657.469916] ? do_trap+0x1d0/0x270 [ 657.470118] ? pskb_expand_head+0x612/0xf40 [ 657.470376] ? pskb_expand_head+0x612/0xf40 [ 657.470620] ? do_error_trap+0xa3/0x170 [ 657.470846] ? pskb_expand_head+0x612/0xf40 [ 657.471092] ? handle_invalid_op+0x2c/0x40 [ 657.471335] ? pskb_expand_head+0x612/0xf40 [ 657.471579] ? exc_invalid_op+0x2d/0x40 [ 657.471805] ? asm_exc_invalid_op+0x1a/0x20 [ 657.472052] ? pskb_expand_head+0xd1/0xf40 [ 657.472292] ? pskb_expand_head+0x612/0xf40 [ 657.472540] ? lock_acquire+0x18f/0x4e0 [ 657.472766] ? find_held_lock+0x2d/0x110 [ 657.472999] ? __pfx_pskb_expand_head+0x10/0x10 [ 657.473263] ? __kmalloc_cache_noprof+0x5b/0x470 [ 657.473537] ? __pfx___lock_release.isra.0+0x10/0x10 [ 657.473826] __pskb_pull_tail+0xfd/0x1d20 [ 657.474062] ? __kasan_slab_alloc+0x4e/0x90 [ 657.474707] sk_psock_skb_ingress_enqueue+0x3bf/0x510 [ 657.475392] ? __kasan_kmalloc+0xaa/0xb0 [ 657.476010] sk_psock_backlog+0x5cf/0xd70 [ 657.476637] process_one_work+0x858/0x1a20 ''' The panic originates from the assertion BUG_ON(skb_shared(skb)) in skb_linearize(). A previous commit(see Fixes tag) introduced skb_get() to avoid race conditions between skb operations in the backlog and skb release in the recvmsg path. However, this caused the panic to always occur when skb_linearize is executed. The "--rx-strp 100000" parameter forces the RX path to use the strparser module which aggregates data until it reaches 100KB before calling sockmap logic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize. To fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue. ''' sk_psock_backlog: sk_psock_handle_skb skb_get(skb) <== we move it into 'sk_psock_skb_ingress_enqueue' sk_psock_skb_ingress____________ ↓ | | → sk_psock_skb_ingress_self | sk_psock_skb_ingress_enqueue sk_psock_verdict_apply_________________↑ skb_linearize ''' Note that for verdict_apply path, the skb_get operation is unnecessary so we add 'take_ref' param to control it's behavior.
References
Impacted products
Vendor Product Version
Linux Linux Version: 923877254f002ae87d441382bb1096d9e773d56d
Version: a454d84ee20baf7bd7be90721b9821f73c7d23d9
Version: a454d84ee20baf7bd7be90721b9821f73c7d23d9
Version: a454d84ee20baf7bd7be90721b9821f73c7d23d9
Version: a454d84ee20baf7bd7be90721b9821f73c7d23d9
Version: 65ad600b9bde68d2d28709943ab00b51ca8f0a1d
Version: e6b5e47adb9166e732cdf7e6e034946e3f89f36d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9718ba6490732dbe70190d42c21deb1440834402",
              "status": "affected",
              "version": "923877254f002ae87d441382bb1096d9e773d56d",
              "versionType": "git"
            },
            {
              "lessThan": "db1d15a26f21f97459508c42ae87cabe8d3afc3b",
              "status": "affected",
              "version": "a454d84ee20baf7bd7be90721b9821f73c7d23d9",
              "versionType": "git"
            },
            {
              "lessThan": "3d25fa2d7f127348c818e1dab9e58534f7ac56cc",
              "status": "affected",
              "version": "a454d84ee20baf7bd7be90721b9821f73c7d23d9",
              "versionType": "git"
            },
            {
              "lessThan": "e9c1299d813fc04668042690f2c3cc76d013959a",
              "status": "affected",
              "version": "a454d84ee20baf7bd7be90721b9821f73c7d23d9",
              "versionType": "git"
            },
            {
              "lessThan": "5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e",
              "status": "affected",
              "version": "a454d84ee20baf7bd7be90721b9821f73c7d23d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "65ad600b9bde68d2d28709943ab00b51ca8f0a1d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6b5e47adb9166e732cdf7e6e034946e3f89f36d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.189",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix panic when calling skb_linearize\n\nThe panic can be reproduced by executing the command:\n./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000\n\nThen a kernel panic was captured:\n\u0027\u0027\u0027\n[  657.460555] kernel BUG at net/core/skbuff.c:2178!\n[  657.462680] Tainted: [W]=WARN\n[  657.463287] Workqueue: events sk_psock_backlog\n...\n[  657.469610]  \u003cTASK\u003e\n[  657.469738]  ? die+0x36/0x90\n[  657.469916]  ? do_trap+0x1d0/0x270\n[  657.470118]  ? pskb_expand_head+0x612/0xf40\n[  657.470376]  ? pskb_expand_head+0x612/0xf40\n[  657.470620]  ? do_error_trap+0xa3/0x170\n[  657.470846]  ? pskb_expand_head+0x612/0xf40\n[  657.471092]  ? handle_invalid_op+0x2c/0x40\n[  657.471335]  ? pskb_expand_head+0x612/0xf40\n[  657.471579]  ? exc_invalid_op+0x2d/0x40\n[  657.471805]  ? asm_exc_invalid_op+0x1a/0x20\n[  657.472052]  ? pskb_expand_head+0xd1/0xf40\n[  657.472292]  ? pskb_expand_head+0x612/0xf40\n[  657.472540]  ? lock_acquire+0x18f/0x4e0\n[  657.472766]  ? find_held_lock+0x2d/0x110\n[  657.472999]  ? __pfx_pskb_expand_head+0x10/0x10\n[  657.473263]  ? __kmalloc_cache_noprof+0x5b/0x470\n[  657.473537]  ? __pfx___lock_release.isra.0+0x10/0x10\n[  657.473826]  __pskb_pull_tail+0xfd/0x1d20\n[  657.474062]  ? __kasan_slab_alloc+0x4e/0x90\n[  657.474707]  sk_psock_skb_ingress_enqueue+0x3bf/0x510\n[  657.475392]  ? __kasan_kmalloc+0xaa/0xb0\n[  657.476010]  sk_psock_backlog+0x5cf/0xd70\n[  657.476637]  process_one_work+0x858/0x1a20\n\u0027\u0027\u0027\n\nThe panic originates from the assertion BUG_ON(skb_shared(skb)) in\nskb_linearize(). A previous commit(see Fixes tag) introduced skb_get()\nto avoid race conditions between skb operations in the backlog and skb\nrelease in the recvmsg path. However, this caused the panic to always\noccur when skb_linearize is executed.\n\nThe \"--rx-strp 100000\" parameter forces the RX path to use the strparser\nmodule which aggregates data until it reaches 100KB before calling sockmap\nlogic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize.\n\nTo fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue.\n\n\u0027\u0027\u0027\nsk_psock_backlog:\n    sk_psock_handle_skb\n       skb_get(skb) \u003c== we move it into \u0027sk_psock_skb_ingress_enqueue\u0027\n       sk_psock_skb_ingress____________\n                                       \u2193\n                                       |\n                                       | \u2192 sk_psock_skb_ingress_self\n                                       |      sk_psock_skb_ingress_enqueue\nsk_psock_verdict_apply_________________\u2191          skb_linearize\n\u0027\u0027\u0027\n\nNote that for verdict_apply path, the skb_get operation is unnecessary so\nwe add \u0027take_ref\u0027 param to control it\u0027s behavior."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:13:59.081Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9718ba6490732dbe70190d42c21deb1440834402"
        },
        {
          "url": "https://git.kernel.org/stable/c/db1d15a26f21f97459508c42ae87cabe8d3afc3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d25fa2d7f127348c818e1dab9e58534f7ac56cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9c1299d813fc04668042690f2c3cc76d013959a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e"
        }
      ],
      "title": "bpf, sockmap: Fix panic when calling skb_linearize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38165",
    "datePublished": "2025-07-03T08:36:05.738Z",
    "dateReserved": "2025-04-16T04:51:23.991Z",
    "dateUpdated": "2025-07-28T04:13:59.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38165\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:31.990\",\"lastModified\":\"2025-07-03T15:13:53.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Fix panic when calling skb_linearize\\n\\nThe panic can be reproduced by executing the command:\\n./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000\\n\\nThen a kernel panic was captured:\\n\u0027\u0027\u0027\\n[  657.460555] kernel BUG at net/core/skbuff.c:2178!\\n[  657.462680] Tainted: [W]=WARN\\n[  657.463287] Workqueue: events sk_psock_backlog\\n...\\n[  657.469610]  \u003cTASK\u003e\\n[  657.469738]  ? die+0x36/0x90\\n[  657.469916]  ? do_trap+0x1d0/0x270\\n[  657.470118]  ? pskb_expand_head+0x612/0xf40\\n[  657.470376]  ? pskb_expand_head+0x612/0xf40\\n[  657.470620]  ? do_error_trap+0xa3/0x170\\n[  657.470846]  ? pskb_expand_head+0x612/0xf40\\n[  657.471092]  ? handle_invalid_op+0x2c/0x40\\n[  657.471335]  ? pskb_expand_head+0x612/0xf40\\n[  657.471579]  ? exc_invalid_op+0x2d/0x40\\n[  657.471805]  ? asm_exc_invalid_op+0x1a/0x20\\n[  657.472052]  ? pskb_expand_head+0xd1/0xf40\\n[  657.472292]  ? pskb_expand_head+0x612/0xf40\\n[  657.472540]  ? lock_acquire+0x18f/0x4e0\\n[  657.472766]  ? find_held_lock+0x2d/0x110\\n[  657.472999]  ? __pfx_pskb_expand_head+0x10/0x10\\n[  657.473263]  ? __kmalloc_cache_noprof+0x5b/0x470\\n[  657.473537]  ? __pfx___lock_release.isra.0+0x10/0x10\\n[  657.473826]  __pskb_pull_tail+0xfd/0x1d20\\n[  657.474062]  ? __kasan_slab_alloc+0x4e/0x90\\n[  657.474707]  sk_psock_skb_ingress_enqueue+0x3bf/0x510\\n[  657.475392]  ? __kasan_kmalloc+0xaa/0xb0\\n[  657.476010]  sk_psock_backlog+0x5cf/0xd70\\n[  657.476637]  process_one_work+0x858/0x1a20\\n\u0027\u0027\u0027\\n\\nThe panic originates from the assertion BUG_ON(skb_shared(skb)) in\\nskb_linearize(). A previous commit(see Fixes tag) introduced skb_get()\\nto avoid race conditions between skb operations in the backlog and skb\\nrelease in the recvmsg path. However, this caused the panic to always\\noccur when skb_linearize is executed.\\n\\nThe \\\"--rx-strp 100000\\\" parameter forces the RX path to use the strparser\\nmodule which aggregates data until it reaches 100KB before calling sockmap\\nlogic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize.\\n\\nTo fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue.\\n\\n\u0027\u0027\u0027\\nsk_psock_backlog:\\n    sk_psock_handle_skb\\n       skb_get(skb) \u003c== we move it into \u0027sk_psock_skb_ingress_enqueue\u0027\\n       sk_psock_skb_ingress____________\\n                                       \u2193\\n                                       |\\n                                       | \u2192 sk_psock_skb_ingress_self\\n                                       |      sk_psock_skb_ingress_enqueue\\nsk_psock_verdict_apply_________________\u2191          skb_linearize\\n\u0027\u0027\u0027\\n\\nNote that for verdict_apply path, the skb_get operation is unnecessary so\\nwe add \u0027take_ref\u0027 param to control it\u0027s behavior.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Se corrige el p\u00e1nico al llamar a skb_linearize El p\u00e1nico se puede reproducir ejecutando el comando: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Luego se captur\u00f3 un p\u00e1nico del kernel: \u0027\u0027\u0027 [ 657.460555] kernel BUG at net/core/skbuff.c:2178! [ 657.462680] Tainted: [W]=WARN [ 657.463287] Workqueue: events sk_psock_backlog ... [ 657.469610]  [ 657.469738] ? die+0x36/0x90 [ 657.469916] ? do_trap+0x1d0/0x270 [ 657.470118] ? pskb_expand_head+0x612/0xf40 [ 657.470376] ? pskb_expand_head+0x612/0xf40 [ 657.470620] ? do_error_trap+0xa3/0x170 [ 657.470846] ? pskb_expand_head+0x612/0xf40 [ 657.471092] ? handle_invalid_op+0x2c/0x40 [ 657.471335] ? pskb_expand_head+0x612/0xf40 [ 657.471579] ? exc_invalid_op+0x2d/0x40 [ 657.471805] ? asm_exc_invalid_op+0x1a/0x20 [ 657.472052] ? pskb_expand_head+0xd1/0xf40 [ 657.472292] ? pskb_expand_head+0x612/0xf40 [ 657.472540] ? lock_acquire+0x18f/0x4e0 [ 657.472766] ? find_held_lock+0x2d/0x110 [ 657.472999] ? __pfx_pskb_expand_head+0x10/0x10 [ 657.473263] ? __kmalloc_cache_noprof+0x5b/0x470 [ 657.473537] ? __pfx___lock_release.isra.0+0x10/0x10 [ 657.473826] __pskb_pull_tail+0xfd/0x1d20 [ 657.474062] ? __kasan_slab_alloc+0x4e/0x90 [ 657.474707] sk_psock_skb_ingress_enqueue+0x3bf/0x510 [ 657.475392] ? __kasan_kmalloc+0xaa/0xb0 [ 657.476010] sk_psock_backlog+0x5cf/0xd70 [ 657.476637] process_one_work+0x858/0x1a20 \u0027\u0027\u0027 El p\u00e1nico se origina en la aserci\u00f3n BUG_ON(skb_shared(skb)) en skb_linearize(). Una confirmaci\u00f3n anterior (v\u00e9ase la etiqueta \\\"Correcciones\\\") introdujo skb_get() para evitar condiciones de ejecuci\u00f3n entre las operaciones de skb en el backlog y la versi\u00f3n de skb en la ruta recvmsg. Sin embargo, esto provocaba que el p\u00e1nico siempre se produjera al ejecutar skb_linearize. El par\u00e1metro \\\"--rx-strp 100000\\\" obliga a la ruta RX a usar el m\u00f3dulo strparser, que agrega datos hasta alcanzar los 100 KB antes de llamar a la l\u00f3gica de sockmap. El payload de 100 KB supera MAX_MSG_FRAGS, lo que activa skb_linearize. Para solucionar este problema, simplemente mueva skb_get a sk_psock_skb_ingress_enqueue. \u0027\u0027\u0027 sk_psock_backlog: sk_psock_handle_skb skb_get(skb) \u0026lt;== lo movemos a \u0027sk_psock_skb_ingress_enqueue\u0027 sk_psock_skb_ingress____________ ? | | ? sk_psock_skb_ingress_self | sk_psock_skb_ingress_enqueue sk_psock_verdict_apply_________________? skb_linearize \u0027\u0027\u0027 Tenga en cuenta que para la ruta verdict_apply, la operaci\u00f3n skb_get es innecesaria, por lo que a\u00f1adimos el par\u00e1metro \u0027take_ref\u0027 para controlar su comportamiento.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d25fa2d7f127348c818e1dab9e58534f7ac56cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9718ba6490732dbe70190d42c21deb1440834402\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db1d15a26f21f97459508c42ae87cabe8d3afc3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9c1299d813fc04668042690f2c3cc76d013959a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.