2828 matches found
CVE-2025-38727
Linux kernel vulnerability CVE-2025-38727 affects netlink in the Linux kernel. A bug in netlink_attachskb() may cause an infinite retry loop when memory checks for skb->truesize against sk_rcvbuf are inconclusive (rmem + skb->truesize > sk_rcvbuf), potentially triggering an rcu_sched sta...
CVE-2025-38727 netlink: avoid infinite retry looping in netlink_unicast()
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlinkunicast netlinkattachskb checks for the socket's read memory allocation constraints. Firstly, it has: rmem skrcvbuf to check if the just increased rmem value fits into the socket's...
CVE-2025-38718 sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctprcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs...
CVE-2025-38718 sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctprcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs...
CVE-2025-38718 sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctprcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs...
rxrpc: Fix recv-recv race of completed call
...
xsk: Fix race condition in AF_XDP generic RX path
...
vmxnet3: unregister xdp rxq info in the reset path
...
net: drop UFO packets in udp_rcv_segment()
...
bnxt_en: Fix receive ring space parameters when XDP is active
...
net: libwx: fix the using of Rx buffer DMA
...
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
...
mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
...
net: libwx: properly reset Rx ring descriptor
...
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
...
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
...
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
...
PT-2025-40071
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's networking subsystem, specifically within the Xilinx Axienet driver. Insufficient error handling during retrieval of RX metadata pointers can lead to...
kernel: can: peak_usb: fix use after free bugs
In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...
kernel: udp: Fix memory accounting leak.
A memory overflow vulnerability exists within the Linux kernel's networking subsystem. Specifically, an application can set the SORCVBUF socket option to its maximum value INTMAX, which triggers an integer overflow within the udprmemrelease function during socket closure. The udpdestructcommon...