cbcvebase.
CVE-2025-22058
published 2025-04-16

CVE-2025-22058: In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.3th percentile
In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops. We can reproduce the issue with the script below [0]: 1. /proc/net/sockstat reports 0 pages # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 0 2. Run the script till the report reaches 524,288 # python3 test.py & sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 3 mem 524288 > PAGE_SHIFT 3. Kill the socket and confirm the number never drops # pkill python3 && sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 524288 4. (necessary since v6.0) Trigger proto_memory_pcpu_drain() # python3 test.py & sleep 1 && pkill python3 5. The number doubles # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 1048577 The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release(). When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable. The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow. Then, the released amount is calculated as follows: 1) Add size to sk->sk_forward_alloc. 2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount. 3) Subtract amount from sk->sk_forward_alloc. 4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated(). When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rm

Affected

33 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
debianlinux-6.1< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
linuxlinux
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < 13550273171f5108b1ac572d8f72f4256ab9285413550273171f5108b1ac572d8f72f4256ab92854
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < d9c8266ce536e8314d84370e983afcaa36fb19cfd9c8266ce536e8314d84370e983afcaa36fb19cf
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < c3ad8c30b6b109283d2643e925f8e65f2e7ab34ec3ad8c30b6b109283d2643e925f8e65f2e7ab34e
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < 9122fec396950cc866137af7154b1d0d989be52e9122fec396950cc866137af7154b1d0d989be52e
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < aeef6456692c6f11ae53d278df64f1316a2a405aaeef6456692c6f11ae53d278df64f1316a2a405a
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < a116b271bf3cb72c8155b6b7f39083c1b80dcd00a116b271bf3cb72c8155b6b7f39083c1b80dcd00
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < c4bac6c398118fba79e32b1cd01db22dbfe29fbfc4bac6c398118fba79e32b1cd01db22dbfe29fbf
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < 3836029448e76c1e6f77cc5fe0adc09b018b5fa83836029448e76c1e6f77cc5fe0adc09b018b5fa8
linuxlinux>= f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb < df207de9d9e7a4d92f8567e2c539d9c8c12fd99ddf207de9d9e7a4d92f8567e2c539d9c8c12fd99d
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.135-16.1.135-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 5.15.0-170.1805.15.0-170.180
linuxlinux_kernel>= 0 < 6.8.0-86.876.8.0-86.87
linuxlinux_kernel>= 0 < 6.14.0-22.226.14.0-22.22
linuxlinux_kernel>= 4.10 < 5.4.3015.4.301
linuxlinux_kernel>= 5.11 < 5.15.1955.15.195
linuxlinux_kernel>= 5.16 < 6.1.1346.1.134
linuxlinux_kernel>= 5.5 < 5.10.2465.10.246
linuxlinux_kernel>= 6.13 < 6.13.116.13.11
linuxlinux_kernel>= 6.14 < 6.14.26.14.2

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc7.1HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.