Executive brief
A vulnerability in the Linux kernel's Netlink networking component could allow a local user to crash the system. By sending a large volume of specific network data, an attacker can bypass memory limits, causing the system to run out of memory (OOM). This results in a denial-of-service condition, impacting the availability of the affected server or device.
Technical details
A vulnerability exists in net/netlink/af_netlink.c due to improper handling of the sk_rmem_alloc variable. The kernel performs signed integer comparisons between the current receive memory allocation and the configured receive buffer limit (sk_rcvbuf). If a user sets a high buffer limit via SO_RCVBUFFORCE, the comparison can fail to trigger, allowing an attacker to continuously allocate socket buffer (skb) structures. This leads to an integer wraparound of the allocation counter and eventually triggers an Out-Of-Memory (OOM) killer event. The fix involves using atomic_add_return() and performing comparisons using unsigned integers to ensure limits are correctly enforced.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.15.7
Timeline
- 2025-07-04: other: Initial patch authored
- 2025-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4b8e18af7bea92f8b7fb92d40aeae729209db250
- https://git.kernel.org/stable/c/55baecb9eb90238f60a8350660d6762046ebd3bd
- https://git.kernel.org/stable/c/76602d8e13864524382b0687dc32cd8f19164d5a
- https://git.kernel.org/stable/c/9da025150b7c14a8390fc06aea314c0a4011e82c
- https://git.kernel.org/stable/c/ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc
- https://git.kernel.org/stable/c/c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98
- https://git.kernel.org/stable/c/cd7ff61bfffd7000143c42bbffb85eeb792466d6