CVE-2025-21926

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: gso: fix ownership in __udp_gso_segment

In __udp_gso_segment the skb destructor is removed before segmenting the

skb but the socket reference is kept as-is. This is an issue if the

original skb is later orphaned as we can hit the following bug:

kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan)

RIP: 0010:ip_rcv_core+0x8b2/0xca0

Call Trace:

ip_rcv+0xab/0x6e0

__netif_receive_skb_one_core+0x168/0x1b0

process_backlog+0x384/0x1100

__napi_poll.constprop.0+0xa1/0x370

net_rx_action+0x925/0xe50

The above can happen following a sequence of events when using

OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an

OVS_ACTION_ATTR_OUTPUT action:

1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb

goes through queue_gso_packets and then __udp_gso_segment, where its

destructor is removed.

2. The segments' data are copied and sent to userspace.

3. OVS_ACTION_A

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References