Junglewise Threat Intelligence

CVE-2025-38124: Linux Kernel denial of service in UDP GSO segmentation

CVE-2025-38124 · Severity: medium · CVSS 5.5 · Published 2025-07-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system processes specific types of UDP network traffic that have been modified by other system tools like firewalls or specialized networking scripts. This results in a 'kernel panic' or 'oops,' leading to a complete service outage on the affected machine.

Technical details

A vulnerability exists in the Linux kernel's networking stack, specifically within the UDP Generic Segmentation Offload (GSO) path. When datapath hooks such as NAT or BPF (via bpf_skb_pull_data) modify SKB_GSO_FRAGLIST packets, they can break invariants expected by the segmentation engine. Specifically, if part of a fraglist payload is pulled into the head_skb, subsequent calls to skb_segment() trigger a kernel BUG at net/core/skbuff.c. The fix involves linearizing these packets in __udp_gso_segment() when they fail to meet basic fraglist invariants, ensuring they are handled safely by the standard segmentation path. This issue is reachable via local triggers that influence network packet processing.

Affected products

  • Linux Linux Kernel 6.1.113 to 6.1.142, 6.6.55 to 6.6.94, 6.10.14 to 6.11, 6.11.3 to 6.12, 6.12.1 to 6.12.34, 6.13 to 6.15.3

Timeline

  • 2025-05-30: patched: Initial patch authored by Shiming Cheng
  • 2025-07-03: disclosed: CVE published

References

Related threats