CVE-2025-38463

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Correct signedness in skb remaining space calculation

Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.

When we send data, if an skb exists at the tail of the write queue, the

kernel will attempt to append the new data to that skb. However, the code

that checks for available space in the skb is flawed:

'''

copy = size_goal - skb->len

'''

The types of the variables involved are:

'''

copy: ssize_t (s64 on 64-bit systems)

size_goal: int

skb->len: unsigned int

'''

Due to C's type promotion rules, the signed size_goal is converted to an

unsigned int to match skb->len before the subtraction. The result is an

unsigned int.

When this unsigned int result is then assigned to the s64 copy variable,

it is zero-extended, preserving its non-negative value. Consequently, copy

is always >= 0.

Assume we are sending 2GB of data and size_goal has been adjusted to a

value smaller than skb->len. The subtract

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References