CVE-2025-38124

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix udp gso skb_segment after pull from frag_list

Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after

pull from frag_list") detected invalid geometry in frag_list skbs and

redirects them from skb_segment_list to more robust skb_segment. But some

packets with modified geometry can also hit bugs in that code. We don't

know how many such cases exist. Addressing each one by one also requires

touching the complex skb_segment code, which risks introducing bugs for

other types of skbs. Instead, linearize all these packets that fail the

basic invariants on gso fraglist skbs. That is more robust.

If only part of the fraglist payload is pulled into head_skb, it will

always cause exception when splitting skbs by skb_segment. For detailed

call stack information, see below.

Valid SKB_GSO_FRAGLIST skbs

- consist of two or more segments

- the head_skb holds the protocol headers plus first gso_size

- one o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References