CVE-2025-38463 (GCVE-0-2025-38463)
Vulnerability from cvelistv5
Published
2025-07-25 15:27
Modified
2026-08-05 12:02
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal - skb->len ''' The types of the variables involved are: ''' copy: ssize_t (s64 on 64-bit systems) size_goal: int skb->len: unsigned int ''' Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int. When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0. Assume we are sending 2GB of data and size_goal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which can easily cause it to overflow. The syzkaller reproducer uses TCP_REPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause sk_forward_alloc to wrap around and become negative. [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47
References
Impacted products
Vendor Product Version
Linux Linux Version: 270a1c3de47e49dd2fc18f48e46b101e48050e78
Version: 270a1c3de47e49dd2fc18f48e46b101e48050e78
Version: 270a1c3de47e49dd2fc18f48e46b101e48050e78
Version: 270a1c3de47e49dd2fc18f48e46b101e48050e78
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81373cd1d72d87c7d844d4454a526b8f53e72d00",
              "status": "affected",
              "version": "270a1c3de47e49dd2fc18f48e46b101e48050e78",
              "versionType": "git"
            },
            {
              "lessThan": "62e6160cfb5514787bda833d466509edc38fde23",
              "status": "affected",
              "version": "270a1c3de47e49dd2fc18f48e46b101e48050e78",
              "versionType": "git"
            },
            {
              "lessThan": "9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7",
              "status": "affected",
              "version": "270a1c3de47e49dd2fc18f48e46b101e48050e78",
              "versionType": "git"
            },
            {
              "lessThan": "d3a5f2871adc0c61c61869f37f3e697d97f03d8c",
              "status": "affected",
              "version": "270a1c3de47e49dd2fc18f48e46b101e48050e78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Correct signedness in skb remaining space calculation\n\nSyzkaller reported a bug [1] where sk-\u003esk_forward_alloc can overflow.\n\nWhen we send data, if an skb exists at the tail of the write queue, the\nkernel will attempt to append the new data to that skb. However, the code\nthat checks for available space in the skb is flawed:\n\u0027\u0027\u0027\ncopy = size_goal - skb-\u003elen\n\u0027\u0027\u0027\n\nThe types of the variables involved are:\n\u0027\u0027\u0027\ncopy: ssize_t (s64 on 64-bit systems)\nsize_goal: int\nskb-\u003elen: unsigned int\n\u0027\u0027\u0027\n\nDue to C\u0027s type promotion rules, the signed size_goal is converted to an\nunsigned int to match skb-\u003elen before the subtraction. The result is an\nunsigned int.\n\nWhen this unsigned int result is then assigned to the s64 copy variable,\nit is zero-extended, preserving its non-negative value. Consequently, copy\nis always \u003e= 0.\n\nAssume we are sending 2GB of data and size_goal has been adjusted to a\nvalue smaller than skb-\u003elen. The subtraction will result in copy holding a\nvery large positive integer. In the subsequent logic, this large value is\nused to update sk-\u003esk_forward_alloc, which can easily cause it to overflow.\n\nThe syzkaller reproducer uses TCP_REPAIR to reliably create this\ncondition. However, this can also occur in real-world scenarios. The\ntcp_bound_to_half_wnd() function can also reduce size_goal to a small\nvalue. This would cause the subsequent tcp_wmem_schedule() to set\nsk-\u003esk_forward_alloc to a value close to INT_MAX. Further memory\nallocation requests would then cause sk_forward_alloc to wrap around and\nbecome negative.\n\n[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires the attacker to issue `sendmsg()`/`sendfile()` on a local TCP socket (with MSG_OOB, MSG_ZEROCOPY, MSG_SPLICE_PAGES, or TCP_REPAIR), so the entry point is a local syscall; a remote peer can only influence `size_goal` via MSS/PMTU/window, it cannot drive the send path on its own.\nAC:L - The attacker fully controls both sides of the condition \u2014 it queues a large tail skb via TCP_CORK/MSG_MORE and then shrinks `size_goal` deterministically with MSG_OOB (`tcp_xmit_size_goal(..., large_allowed=0)`) or TCP_REPAIR, exactly as the syzkaller reproducer does; no race or uncontrollable state is involved.\nPR:L - An ordinary unprivileged user can open a TCP socket, set SO_ZEROCOPY and TCP_CORK, and send with MSG_OOB/MSG_ZEROCOPY with no capabilities; the TCP_REPAIR variant only needs CAP_NET_ADMIN in a user namespace, obtainable via `unshare -Urn`.\nUI:N - The attacking process performs every step itself through ordinary socket syscalls; no victim action, mount, or file open is required.\nS:U - The overflow corrupts socket memory accounting and kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Once `sk_forward_alloc` wraps negative, `tcp_wmem_schedule()` returns a negative `copy` that corrupts skb frag lengths via `skb_frag_size_add()`/`skb_fill_page_desc()`, causing adjacent kernel heap memory to be included in transmitted packets, and the resulting heap corruption is leverageable for broader kernel memory disclosure.\nI:H - The negative `copy` is converted to a huge `size_t` in `skb_do_copy_data_nocache()` \u2192 `copy_from_iter_full()`, writing attacker-controlled data far past the `page_frag` allocation \u2014 an out-of-bounds heap write suitable for control-flow hijacking.\nA:H - The `sk_forward_alloc` overflow trips `WARN_ON_ONCE()` in `inet_sock_destruct()` (kernel panic with panic_on_warn) and permanently inflates the global `tcp_memory_allocated` counter, forcing the entire host into TCP memory pressure so all TCP sockets fail to allocate \u2014 a repeatable system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:05.755Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81373cd1d72d87c7d844d4454a526b8f53e72d00"
        },
        {
          "url": "https://git.kernel.org/stable/c/62e6160cfb5514787bda833d466509edc38fde23"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3a5f2871adc0c61c61869f37f3e697d97f03d8c"
        }
      ],
      "title": "tcp: Correct signedness in skb remaining space calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38463",
    "datePublished": "2025-07-25T15:27:45.975Z",
    "dateReserved": "2025-04-16T04:51:24.020Z",
    "dateUpdated": "2026-08-05T12:02:05.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.