CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment
In the Linux kernel, the following vulnerability has been resolved:
net: gso: fix ownership in udpgsosegment
In udpgsosegment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skborphan) RIP: 0010:iprcvcore+0x8b2/0xca0 Call Trace: iprcv+0xab/0x6e0 netifreceiveskbonecore+0x168/0x1b0 processbacklog+0x384/0x1100 napipoll.constprop.0+0xa1/0x370 netrxaction+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVSACTIONATTRUSERSPACE action precedes an OVSACTIONATTROUTPUT action:
1. OVSACTIONATTRUSERSPACE is handled (in doexecuteactions): the skb goes through queuegsopackets and then udpgsosegment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVSACTIONATTROUTPUT is handled (in doexecuteactions) and the same original skb is sent to its path. 4. If it later hits skborphan, we hit the bug.
Fix this by also removing the reference to the socket in udpgsosegment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21926?
CVE-2025-21926 has been classified with a significant severity level due to its potential impact on network functions in the Linux kernel.
How do I fix CVE-2025-21926?
To fix CVE-2025-21926, upgrade the Linux kernel to the latest patched version where this vulnerability has been addressed.
What kind of systems are affected by CVE-2025-21926?
CVE-2025-21926 affects systems running vulnerable versions of the Linux kernel that utilize the GSO networking feature.
What are the potential consequences of CVE-2025-21926?
Exploitation of CVE-2025-21926 could lead to memory corruption and possibly remote code execution under certain conditions.
Is there a workaround for CVE-2025-21926 until a patch is applied?
Currently, there are no known effective workarounds for CVE-2025-21926, so immediate kernel updates are recommended.