CVE-2025-38057 (GCVE-0-2025-38057)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-08-05 11:59
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfree_skb.
References
Impacted products
Vendor Product Version
Linux Linux Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:52.542424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:06.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c",
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05db2b850a2b8b17f3d1799f563ea1d550e05ed5",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "d8d79cf8c2b7475c22f9874eb844bcc80f858b13",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "28756f22de48d25256ed89234b66b9037a3f0157",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "eb058693dfc93ed7a9c365adb899fedd648b9d9f",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "63c1f19a3be3169e51a5812d22a6d0c879414076",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c",
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: fix skb leaks\n\nA few error paths are missing a kfree_skb."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - espintcp exists specifically to carry IPsec over TCP across the public internet, and both leak triggers are driven by network events \u2014 a remote peer resetting/closing the espintcp TCP connection (making `inet_lookup_established` fail) and remotely induced outbound traffic volume that overflows `out_queue` past `net_hotdata.max_backlog`. The skbs are leaked in the network datapath from a softirq/workqueue re-injection context, with no local access required.\nAC:L - The attacker controls both trigger conditions directly \u2014 packet rate through the tunnel and the state of the espintcp TCP connection \u2014 and each qualifying packet leaks an skb deterministically with no memory-layout or timing requirement beyond the attacker\u0027s influence. The kernel discards the error return in `xfrm_trans_reinject()`, so the leak is guaranteed, not probabilistic.\nPR:N - No credentials on the target are needed: an unauthenticated remote host can send packets that elicit reply traffic routed out over the espintcp SA, and the remote TCP peer can tear down the espintcp connection at will. Locally the path is reachable by any unprivileged user simply sending traffic matching the IPsec policy.\nUI:N - The leak occurs entirely within kernel packet processing on the xfrm output path; no administrator or user action on the victim system is required once the espintcp SA is configured.\nS:U - The leaked memory and the resulting resource exhaustion are confined to the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:N - The bug is a missing `kfree_skb()` \u2014 memory is simply never released. No stale or out-of-bounds data is read or exposed to the attacker, and no kernel addresses are disclosed.\nI:N - No memory corruption, out-of-bounds write, or type confusion occurs; the skb is never reused after the missed free, so there is no write primitive or data modification.\nA:H - This is an unbounded, attacker-rate-driven leak in the network fast path \u2014 with the espintcp socket gone, every outbound ESP packet permanently leaks a full skb, exhausting kernel memory and driving the system to OOM. The leaked skbs also retain their `dst_entry` (and thus netdev) references, which additionally pins device refcounts and can hang network-namespace teardown indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:07.403Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/05db2b850a2b8b17f3d1799f563ea1d550e05ed5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8d79cf8c2b7475c22f9874eb844bcc80f858b13"
        },
        {
          "url": "https://git.kernel.org/stable/c/28756f22de48d25256ed89234b66b9037a3f0157"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb058693dfc93ed7a9c365adb899fedd648b9d9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/63c1f19a3be3169e51a5812d22a6d0c879414076"
        }
      ],
      "title": "espintcp: fix skb leaks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38057",
    "datePublished": "2025-06-18T09:33:37.148Z",
    "dateReserved": "2025-04-16T04:51:23.979Z",
    "dateUpdated": "2026-08-05T11:59:07.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38057\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:52.542424Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:37:43.729Z\"}}], \"cna\": {\"title\": \"espintcp: fix skb leaks\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"05db2b850a2b8b17f3d1799f563ea1d550e05ed5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"d8d79cf8c2b7475c22f9874eb844bcc80f858b13\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"28756f22de48d25256ed89234b66b9037a3f0157\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"eb058693dfc93ed7a9c365adb899fedd648b9d9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\", \"lessThan\": \"63c1f19a3be3169e51a5812d22a6d0c879414076\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/esp4.c\", \"net/ipv6/esp6.c\", \"net/xfrm/espintcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.14.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/esp4.c\", \"net/ipv6/esp6.c\", \"net/xfrm/espintcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/05db2b850a2b8b17f3d1799f563ea1d550e05ed5\"}, {\"url\": \"https://git.kernel.org/stable/c/e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b\"}, {\"url\": \"https://git.kernel.org/stable/c/d8d79cf8c2b7475c22f9874eb844bcc80f858b13\"}, {\"url\": \"https://git.kernel.org/stable/c/28756f22de48d25256ed89234b66b9037a3f0157\"}, {\"url\": \"https://git.kernel.org/stable/c/eb058693dfc93ed7a9c365adb899fedd648b9d9f\"}, {\"url\": \"https://git.kernel.org/stable/c/63c1f19a3be3169e51a5812d22a6d0c879414076\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nespintcp: fix skb leaks\\n\\nA few error paths are missing a kfree_skb.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.159\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.117\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.31\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14.9\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:20:26.323Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38057\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:06.505Z\", \"dateReserved\": \"2025-04-16T04:51:23.979Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-06-18T09:33:37.148Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.