linux-cve-announce - CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072508-CVE-2025-38463-f4a1@gregkh>
Date: Fri, 25 Jul 2025 17:28:25 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38463: tcp: Correct signedness in skb remaining space calculation

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tcp: Correct signedness in skb remaining space calculation

Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.

When we send data, if an skb exists at the tail of the write queue, the
kernel will attempt to append the new data to that skb. However, the code
that checks for available space in the skb is flawed:
'''
copy = size_goal - skb->len
'''

The types of the variables involved are:
'''
copy: ssize_t (s64 on 64-bit systems)
size_goal: int
skb->len: unsigned int
'''

Due to C's type promotion rules, the signed size_goal is converted to an
unsigned int to match skb->len before the subtraction. The result is an
unsigned int.

When this unsigned int result is then assigned to the s64 copy variable,
it is zero-extended, preserving its non-negative value. Consequently, copy
is always >= 0.

Assume we are sending 2GB of data and size_goal has been adjusted to a
value smaller than skb->len. The subtraction will result in copy holding a
very large positive integer. In the subsequent logic, this large value is
used to update sk->sk_forward_alloc, which can easily cause it to overflow.

The syzkaller reproducer uses TCP_REPAIR to reliably create this
condition. However, this can also occur in real-world scenarios. The
tcp_bound_to_half_wnd() function can also reduce size_goal to a small
value. This would cause the subsequent tcp_wmem_schedule() to set
sk->sk_forward_alloc to a value close to INT_MAX. Further memory
allocation requests would then cause sk_forward_alloc to wrap around and
become negative.

[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

The Linux kernel CVE team has assigned CVE-2025-38463 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit 270a1c3de47e49dd2fc18f48e46b101e48050e78 and fixed in 6.6.99 with commit 81373cd1d72d87c7d844d4454a526b8f53e72d00
	Issue introduced in 6.5 with commit 270a1c3de47e49dd2fc18f48e46b101e48050e78 and fixed in 6.12.39 with commit 62e6160cfb5514787bda833d466509edc38fde23
	Issue introduced in 6.5 with commit 270a1c3de47e49dd2fc18f48e46b101e48050e78 and fixed in 6.15.7 with commit 9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7
	Issue introduced in 6.5 with commit 270a1c3de47e49dd2fc18f48e46b101e48050e78 and fixed in 6.16-rc6 with commit d3a5f2871adc0c61c61869f37f3e697d97f03d8c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38463
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/tcp.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/81373cd1d72d87c7d844d4454a526b8f53e72d00
	https://git.kernel.org/stable/c/62e6160cfb5514787bda833d466509edc38fde23
	https://git.kernel.org/stable/c/9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7
	https://git.kernel.org/stable/c/d3a5f2871adc0c61c61869f37f3e697d97f03d8c