CVE-2025-38465

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netlink: Fix wraparounds of sk->sk_rmem_alloc.

Netlink has this pattern in some places

if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)

atomic_add(skb->truesize, &sk->sk_rmem_alloc);

, which has the same problem fixed by commit 5a465a0da13e ("udp:

Fix multiple wraparounds of sk->sk_rmem_alloc.").

For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition

is always false as the two operands are of int.

Then, a single socket can eat as many skb as possible until OOM

happens, and we can see multiple wraparounds of sk->sk_rmem_alloc.

Let's fix it by using atomic_add_return() and comparing the two

variables as unsigned int.

Before:

[root@fedora ~]# ss -f netlink

Recv-Q Send-Q Local Address:Port Peer Address:Port

-1668710080 0 rtnl:nl_wraparound/293 *

After:

[root@fedora ~]# ss -f netlink

Recv-Q Send-Q Local Address:Port Peer

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References