UBUNTU-CVE-2025-38124: High severity ubuntu/linux-hwe-edge vulnerability

Q: What conditions make systems realistically exposed to this issue?

Exposure is tied to UDP GSO packets using SKB_GSO_FRAGLIST whose geometry has been modified so that the required fraglist invariants no longer hold. Optional datapath hooks such as NAT and BPF programs using bpf_skb_pull_data can create these conditions.

Q: What impact is described if the vulnerable path is reached?

The affected packet processing can hit exceptions while splitting SKBs, and the supplied severity vector identifies availability impact as high. No confidentiality or integrity impact is identified in that vector.

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are linux-azure-fde, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-gke, and linux-gkeop.

Q: How can administrators assess whether their configuration may trigger the issue?

Review whether the system processes UDP GSO fraglist packets through NAT or BPF datapath hooks, particularly BPF programs that call bpf_skb_pull_data. Such processing can pull only part of the fraglist payload into the head SKB and break the geometry expected by skb_segment.

Published Jul 3, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skbsegment after pull from fraglist Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from fraglist") detected invalid geometry in fraglist skbs and redirects them from skbsegmentlist to more robust skbsegment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skbsegment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into headskb, it will always cause exception when splitting skbs by skbsegment. For detailed call stack information, see below. Valid SKBGSOFRAGLIST skbs - consist of two or more segments - the headskb holds the protocol headers plus first gsosize - one or more fraglist skbs hold exactly one segment - all but the last must be gsosize Optional datapath hooks such as NAT and BPF (bpfskbpulldata) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKBGSOFRAGLIST conditions because payload was pulled into headskb, it needs to be linearized before pass to regular skbsegment. skbsegment+0xcd0/0xd14 udpgsosegment+0x334/0x5f4 udp4ufofragment+0x118/0x15c inetgsosegment+0x164/0x338 skbmacgsosegment+0xc4/0x13c skbgsosegment+0xc4/0x124 validatexmitskb+0x9c/0x2c0 validatexmitskblist+0x4c/0x80 schdirectxmit+0x70/0x404 devqueuexmit+0x64c/0xe5c neighresolveoutput+0x178/0x1c4 ipfinishoutput2+0x37c/0x47c ipfinishoutput+0x194/0x240 ipfinishoutput+0x20/0xf4 ipoutput+0x100/0x1a0 NFHOOK+0xc4/0x16c ipforward+0x314/0x32c iprcv+0x90/0x118 netifreceiveskb+0x74/0x124 processbacklog+0xe8/0x1a4 napipoll+0x5c/0x1f8 netrxaction+0x154/0x314 handlesoftirqs+0x154/0x4b8 [118.376811] [C201134] rxq0pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278! [118.376829] [C201134] rxq0pus: [name:traps&]Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [118.470774] [C201134] rxq0pus: [name:mrdump&]Kernel Offset: 0x178cc00000 from 0xffffffc008000000 [118.470810] [C201134] rxq0pus: [name:mrdump&]PHYSOFFSET: 0x40000000 [118.470827] [C201134] rxq0pus: [name:mrdump&]pstate: 60400005 (nZCv daif +PAN -UAO) [118.470848] [C201134] rxq0pus: [name:mrdump&]pc : [0xffffffd79598aefc] skbsegment+0xcd0/0xd14 [118.470900] [C201134] rxq0pus: [name:mrdump&]lr : [0xffffffd79598a5e8] skbsegment+0x3bc/0xd14 [118.470928] [C201134] rxq0pus: [name:mrdump&]sp : ffffffc008013770

Affected Software

131 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1047.50~22.04.2

6.8.0-1047.50~22.04.2

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1044.44~22.04.1

6.8.0-1044.44~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-100.100.1~22.04.1

6.8.0-100.100.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1043.44~22.04.1

6.8.0-1043.44~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1041.42~22.04.1

6.8.1-1041.42~22.04.1

ubuntu/linux<6.8.0-100.100

6.8.0-100.100

ubuntu/linux-aws<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-aws-6.14<6.14.0-1013.13~24.04.1

6.14.0-1013.13~24.04.1

ubuntu/linux-azure<6.8.0-1046.52

6.8.0-1046.52

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14<6.14.0-1007.7

6.14.0-1007.7

ubuntu/linux-gcp<6.8.0-1047.50

6.8.0-1047.50

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1016.17~24.04.1

6.14.0-1016.17~24.04.1

ubuntu/linux-gke<6.8.0-1043.48

6.8.0-1043.48

ubuntu/linux-gkeop<6.8.0-1030.33

6.8.0-1030.33

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1044.44

6.8.0-1044.44

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-100.100.1

6.8.0-100.100.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1046.49.1

6.8.0-1046.49.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1012.12

6.14.0-1012.12

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1043.44

6.8.0-1043.44

ubuntu/linux-oracle-6.14<6.14.0-1013.13~24.04.1

6.14.0-1013.13~24.04.1

ubuntu/linux-raspi<6.8.0-1047.51

6.8.0-1047.51

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-32.32.1~24.04.1

6.14.0-32.32.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1023.24

6.8.0-1023.24

ubuntu/linux-bluefield<6.8.0-1016.20

6.8.0-1016.20

ubuntu/linux-raspi-realtime<6.8.0-2037.38

6.8.0-2037.38

ubuntu/linux-realtime<6.8.1-1041.42

6.8.1-1041.42

ubuntu/linux-realtime-6.14<6.14.0-1012.12~24.04.1

6.14.0-1012.12~24.04.1

ubuntu/linux-aws-fips<6.8.0-1046.49+fips1

6.8.0-1046.49+fips1

ubuntu/linux-azure-fips<6.8.0-1046.52+fips1

6.8.0-1046.52+fips1

ubuntu/linux-fips<6.8.0-100.100+fips1

6.8.0-100.100+fips1

ubuntu/linux-gcp-fips<6.8.0-1047.50+fips1

6.8.0-1047.50+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50~22.04.2
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-azure-nvidia-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1007.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.17~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.48
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.33
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1012.12
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.51
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-32.32.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.20
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2037.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50+fips1
Compensating control
Linearize all SKB_GSO_FRAGLIST packets whose payload was pulled into head_skb or that fail the basic fraglist invariants before passing them to regular skb_segment.

Event History

Jul 3, 2025

CVE Published

via OSV·09:15 AM

Data Sourced

via OSV·09:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions make systems realistically exposed to this issue?

Exposure is tied to UDP GSO packets using SKB_GSO_FRAGLIST whose geometry has been modified so that the required fraglist invariants no longer hold. Optional datapath hooks such as NAT and BPF programs using bpf_skb_pull_data can create these conditions.

What impact is described if the vulnerable path is reached?

The affected packet processing can hit exceptions while splitting SKBs, and the supplied severity vector identifies availability impact as high. No confidentiality or integrity impact is identified in that vector.

Which Ubuntu kernel packages are identified as affected?

The listed packages are linux-azure-fde, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-gke, and linux-gkeop.

How can administrators assess whether their configuration may trigger the issue?

Review whether the system processes UDP GSO fraglist packets through NAT or BPF datapath hooks, particularly BPF programs that call bpf_skb_pull_data. Such processing can pull only part of the fraglist payload into the head SKB and break the geometry expected by skb_segment.

UBUNTU-CVE-2025-38124: High severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions make systems realistically exposed to this issue?

What impact is described if the vulnerable path is reached?

Which Ubuntu kernel packages are identified as affected?

How can administrators assess whether their configuration may trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

What conditions make systems realistically exposed to this issue?

What impact is described if the vulnerable path is reached?

Which Ubuntu kernel packages are identified as affected?

How can administrators assess whether their configuration may trigger the issue?