CVE-2025-38185

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

atm: atmtcp: Free invalid length skb in atmtcp_c_send().

syzbot reported the splat below. [0]

vcc_sendmsg() copies data passed from userspace to skb and passes

it to vcc->dev->ops->send().

atmtcp_c_send() accesses skb->data as struct atmtcp_hdr after

checking if skb->len is 0, but it's not enough.

Also, when skb->len == 0, skb and sk (vcc) were leaked because

dev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing

to revert atm_account_tx() in vcc_sendmsg(), which is expected

to be done in atm_pop_raw().

Let's properly free skb with an invalid length in atmtcp_c_send().

[0]:

BUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294

atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294

vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644

sock_sendmsg_nosec net/socket.c:712 [inline]

__sock_sendmsg+0x330/0x3d0 net/socket.c:727

____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566

___sys_sendms

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References