CVE-2025-38727
published 2025-09-04CVE-2025-38727: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid infinite retry looping in netlink_unicast()
netlink_attachskb() checks for the socket's read memory allocation
constraints. Firstly, it has:
rmem sk_rcvbuf)
to check if the just increased rmem value fits into the socket's receive
buffer. If not, it proceeds and tries to wait for the memory under:
rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)
The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is
equal to sk->sk_rcvbuf. Thus the function neither successfully accepts
these conditions, nor manages to reschedule the task - and is called in
retry loop for indefinite time which is caught as:
rcu: INFO: rcu_sched self-detected stall on CPU
rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212
(t=26000 jiffies g=230833 q=259957)
NMI backtrace for cpu 0
CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014
Call Trace:
dump_stack lib/dump_stack.c:120
nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62
rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335
rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590
update_process_times kernel/time/timer.c:1953
tick_sched_handle kernel/time/tick-sched.c:227
tick_sched_timer kernel/time/tick-sched.c:1399
__hrtimer_run_queues kernel/time/hrtimer.c:1652
hrtimer_interrupt kernel/time/hrtimer.c:1717
__sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113
asm_call_irq_on_stack arch/x86/entry/entry_64.S:808
netlink_attachskb net/netlink/af_netlink.c:1234
netlink_unicast net/netlink/af_netlink.c:1349
kauditd_send_queue kernel/audit.c:776
kauditd_thread kernel/audit.c:897
kthread kernel/kthread.c:328
ret_from_fork arch/x86/entry/entry_64.S:304
Restore the original behavior of the check which commit in Fixes
accidentally missed when restructuring the code.
Found b
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4b8e18af7bea92f8b7fb92d40aeae729209db250 < 44ddd7b1ae0b7edb2c832eb16798c827a05e58f0 | 44ddd7b1ae0b7edb2c832eb16798c827a05e58f0 |
| linux | linux | >= 5.10.240 < 5.10.241 | 5.10.241 |
| linux | linux | >= 5.15.189 < 5.15.190 | 5.15.190 |
| linux | linux | >= 5.4.296 < 5.4.297 | 5.4.297 |
| linux | linux | >= 55baecb9eb90238f60a8350660d6762046ebd3bd < 346c820ef5135cf062fa3473da955ef8c5fb6929 | 346c820ef5135cf062fa3473da955ef8c5fb6929 |
| linux | linux | >= 6.1.146 < 6.1.149 | 6.1.149 |
| linux | linux | >= 6.12.39 < 6.12.43 | 6.12.43 |
| linux | linux | >= 6.15.7 < 6.15.11 | 6.15.11 |
| linux | linux | >= 6.6.99 < 6.6.103 | 6.6.103 |
| linux | linux | >= 76602d8e13864524382b0687dc32cd8f19164d5a < d42b71a34f6b8a2d5c53df81169b03b8d8b5cf4e | d42b71a34f6b8a2d5c53df81169b03b8d8b5cf4e |
| linux | linux | >= 9da025150b7c14a8390fc06aea314c0a4011e82c < 47d49fd07f86d1f55ea1083287303d237e9e0922 | 47d49fd07f86d1f55ea1083287303d237e9e0922 |
| linux | linux | >= ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc < e8edc7de688791a337c068693f22e8d8b869df71 | e8edc7de688791a337c068693f22e8d8b869df71 |
| linux | linux | >= ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc < 759dfc7d04bab1b0b86113f1164dc1fec192b859 | 759dfc7d04bab1b0b86113f1164dc1fec192b859 |
| linux | linux | >= c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98 < 6bee383ff83352a693d03efdf27cdd80742f71b2 | 6bee383ff83352a693d03efdf27cdd80742f71b2 |
| linux | linux | >= cd7ff61bfffd7000143c42bbffb85eeb792466d6 < 78fcd69d55c5f11d7694c547eca767a1cfd38ec4 | 78fcd69d55c5f11d7694c547eca767a1cfd38ec4 |
| linux | linux | >= fd69af06101090eaa60b3d216ae715f9c0a58e5b < f324959ad47e62e3cadaffa65d3cff790fb48529 | f324959ad47e62e3cadaffa65d3cff790fb48529 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM