CVE-2025-38463

In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal - skb->len ''' The types of the variables involved are: ''' copy: ssize_t (s64 on 64-bit systems) size_goal: int skb->len: unsigned int ''' Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int. When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0. Assume we are sending 2GB of data and size_goal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which can easily cause it to overflow. The syzkaller reproducer uses TCP_REPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause sk_forward_alloc to wrap around and become negative. [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

• CWE-191

• https://git.kernel.org/stable/c/62e6160cfb5514787bda833d466509edc38fde23Patch
• https://git.kernel.org/stable/c/81373cd1d72d87c7d844d4454a526b8f53e72d00Patch
• https://git.kernel.org/stable/c/9f164fa6bb09fbcc60fa5c3ff551ce9eec1befd7Patch
• https://git.kernel.org/stable/c/d3a5f2871adc0c61c61869f37f3e697d97f03d8cPatch

Published

Jul 25, 2025

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-38458In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38459In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-3846A vulnerability was found in markparticle WebServer up to 1.…9.8
• CVE-2025-38460In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38461In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2025-38462In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2025-38464In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38465In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38466In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38467In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38468In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38469In the Linux kernel, the following vulnerability has been re…5.5