CVE-2025-22059

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udp: Fix multiple wraparounds of sk->sk_rmem_alloc.

__udp_enqueue_schedule_skb() has the following condition:

if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)

goto drop;

sk->sk_rcvbuf is initialised by net.core.rmem_default and later can

be configured by SO_RCVBUF, which is limited by net.core.rmem_max,

or SO_RCVBUFFORCE.

If we set INT_MAX to sk->sk_rcvbuf, the condition is always false

as sk->sk_rmem_alloc is also signed int.

Then, the size of the incoming skb is added to sk->sk_rmem_alloc

unconditionally.

This results in integer overflow (possibly multiple times) on

sk->sk_rmem_alloc and allows a single socket to have skb up to

net.core.udp_mem[1].

For example, if we set a large value to udp_mem[1] and INT_MAX to

sk->sk_rcvbuf and flood packets to the socket, we can see multiple

overflows:

# cat /proc/net/sockstat | grep UDP:

UDP: inuse 3 mem 7956736 <-- (7956736 << 12) bytes > INT_MAX *

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References