CVE-2025-38057

In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfreeskb...

CVE-2025-38057 espintcp: fix skb leaks

In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfreeskb...

CVE-2025-38057 espintcp: fix skb leaks

In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfreeskb...

CVE-2025-38057

CVE-2025-38057 affects the Linux kernel espintcp driver, where skb leaks occurred due to missing kfree_skb on certain error paths. Connected advisories (Astra Linux, Debian, CIRCL, and others) confirm the issue and indicate a fix has been applied in the kernel; Debian LTS references linux-6.1 wit...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ptrring: Do not block hard interrupts in ptrringresizemultiple. Jakub added a lockdepassertnohardirq check in pagepoolputpage to increase test coverage. syzbot identified a crash caused by hard IRQ blocking in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: mcast: added RCU protection to mldnewpack The mldnewpack function can be called without holding RTNL or RCU. It should be noted that we can no longer use sockallocsendskb, because ipv6.igmpsk relies on GFPKERNEL...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: udp: Fixed multiple wraparounds of sk-skrmemalloc. udpenqueuescheduleskb has the following condition: if atomicread&sk-skrmemalloc sk-skrcvbuf goto drop; sk-skrcvbuf is initialized by net.core.rmemdefault and can later be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the rxsk parameter was added to the tracekfreeskb argument array. However, rxsk is optional and can be NULL. Yan Zhai reported that a BPF program could trigger a NULL pointer derefrence if the program did no...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath12k – Fix for invalid access to memory In ath12kdprxmsducoalesce, rxcb is fetched from skb, and boolean iscontinuation is part of rxcb. Currently, after freeing the skb, rxcb-iscontinuation is accessed again, which is...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in udpgsosegment In udpgsosegment, the skb destructor is removed before segmenting the skb, but the reference to the socket remains intact. This issue arises if the original skb becomes orphaned later, as ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fixed the memory leak issue when GSO is enabled. The skb has always been mapped to the LS descriptor. Previously, the skb was mapped to the EXT descriptor when the number of fragments was zero and GSO was enabled...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If the skb allocation fails, the pointer to struct canframe becomes NULL. This issue is actually handled everywhere within ctucanerrinterrupt, except for the only place where it is not...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: Fixed the truesize for the mb-xdp-pass case. When mb-xdp is set and return is XDPPASS, the packet is converted from xdpbuff to skbuff using xdpupdateskbsharedinfo in bnxtxdpbuildskb. However, bnxtxdpbuildskb passes an...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tipc: fixed a memory leak in tipclinkxmit In cases where the backlog transmit queue for system-importance messages becomes overloaded, tipclinkxmit returns -ENOBUFS, but the skb list is not purged. This leads to a memory leak and...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Added a check for mgmtallocskb in mgmtdeviceconnected. Added a check on the return value of mgmtallocskb in mgmtdeviceconnected to prevent null pointer dereferencing...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Do not override retval if we have already lost the skb. If we are redirecting the skb, and have not yet called tcfmirredforward, we need to inform the kernel to discard the skb by setting the retcode to SHOT...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...

kernel: eth: bnxt: fix truesize for mb-xdp-pass case

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDPPASS, packet is converted from xdpbuff to skbuff with xdpupdateskbsharedinfo in bnxtxdpbuildskb. bnxtxdpbuildskb passes incorrect truesize argument ...

PT-2025-27960

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the atmtcp c send function in the Linux kernel, where it accesses skb-data as struct atmtcp hdr after checking if skb-len is 0, but this check is not sufficient...

kernel: net: gso: fix ownership in __udp_gso_segment

In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in udpgsosegment In udpgsosegment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the...