netlink: Fix wraparounds of sk->sk_rmem_alloc.
Netlink has this pattern in some places
if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
atomic_add(skb->truesize, &sk->sk_rmem_alloc);
, which has the same problem fixed by commit 5a465a0da13e ("udp:
Fix multiple wraparounds of sk->sk_rmem_alloc.").
For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition
is always false as the two operands are of int.
Then, a single socket can eat as many skb as possible until OOM
happens, and we can see multiple wraparounds of sk->sk_rmem_alloc.
Let's fix it by using atomic_add_return() and comparing the two
variables as unsigned int.
Before:
[root@fedora ~]# ss -f netlink
Recv-Q Send-Q Local Address:Port Peer Address:Port
-1668710080 0 rtnl:nl_wraparound/293 *
After:
[root@fedora ~]# ss -f netlink
Recv-Q Send-Q Local Address:Port Peer Address:Port
2147483072 0 rtnl:nl_wraparound/290 *
^
`--- INT_MAX - 576
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4327-1 | linux security update |
Debian DLA |
DLA-4328-1 | linux-6.1 security update |
Debian DSA |
DSA-5973-1 | linux security update |
Debian DSA |
DSA-5975-1 | linux security update |
EUVD |
EUVD-2025-22676 | In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc."). For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc. Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int. Before: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port -1668710080 0 rtnl:nl_wraparound/293 * After: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576 |
Ubuntu USN |
USN-7774-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7774-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7774-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7775-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7775-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7776-1 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-7775-3 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7774-4 | Linux kernel (KVM) vulnerabilities |
Ubuntu USN |
USN-7774-5 | Linux kernel (NVIDIA Tegra IGX) vulnerabilities |
Ubuntu USN |
USN-7879-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7879-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7880-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-7879-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7879-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7934-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8028-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8028-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8031-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8028-3 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-8028-4 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-8028-5 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8031-2 | Linux kernel (GCP FIPS) vulnerabilities |
Ubuntu USN |
USN-8028-6 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-8031-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8052-1 | Linux kernel (Low Latency) vulnerabilities |
Ubuntu USN |
USN-8028-7 | Linux kernel (Low Latency NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8028-8 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-8052-2 | Linux kernel (Xilinx) vulnerabilities |
Ubuntu USN |
USN-8074-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8074-2 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8126-1 | Linux kernel (Azure) vulnerabilities |
Tue, 12 May 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 22 Dec 2025 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Debian
Debian debian Linux |
|
| Weaknesses | CWE-401 | |
| CPEs | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* |
|
| Vendors & Products |
Debian
Debian debian Linux |
Mon, 03 Nov 2025 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 29 Jul 2025 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Sat, 26 Jul 2025 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Vendors & Products |
Linux
Linux linux Kernel |
Fri, 25 Jul 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc."). For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc. Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int. Before: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port -1668710080 0 rtnl:nl_wraparound/293 * After: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576 | |
| Title | netlink: Fix wraparounds of sk->sk_rmem_alloc. | |
| References |
|
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-12T12:05:00.951Z
Reserved: 2025-04-16T04:51:24.020Z
Link: CVE-2025-38465
No data.
Status : Modified
Published: 2025-07-25T16:15:32.527
Modified: 2026-05-12T13:16:49.950
Link: CVE-2025-38465
OpenCVE Enrichment
Updated: 2025-07-26T11:22:09Z
Debian DLA
Debian DSA
EUVD
Ubuntu USN