Executive brief
The Linux kernel's network stack contains an integer overflow vulnerability in the kmalloc_reserve() function that can be triggered when a network device's MTU (Maximum Transmission Unit) is set to an abnormally large value. An attacker with the ability to configure network device settings can trigger a crash or potential memory corruption, disrupting network operations and potentially enabling further exploitation.
Technical details
The vulnerability exists in kmalloc_reserve() where a 32-bit variable (obj_size) truncates the result of kmalloc_size_roundup() when the allocation size exceeds 0x80000001 bytes. When kmalloc_size_roundup() returns 2^32 for large sizes, the 32-bit variable truncates this to 0, causing kmalloc(0) to be called, which returns ZERO_SIZE_PTR. This pointer is not properly handled by socket buffer (skb) allocation functions. The vulnerability can be triggered by setting a network device's MTU close to 0x7fffffff. The crash occurs in the network core skbuff handling code during memory initialization operations.
Affected products
- Linux Linux kernel 6.1.39 and earlier versions with the vulnerable kmalloc_reserve() implementation
Timeline
- 2025-12-08: disclosed