CVE-2025-39758

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages

Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"),

we have been doing this:

static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,

size_t size)

[...]

/* Calculate the number of bytes we need to push, for this page

* specifically */

size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);

/* If we can't splice it, then copy it in, as normal */

if (!sendpage_ok(page[i]))

msg.msg_flags &= ~MSG_SPLICE_PAGES;

/* Set the bvec pointing to the page, with len $bytes */

bvec_set_page(&bvec, page[i], bytes, offset);

/* Set the iter to $size, aka the size of the whole sendpages (!!!) */

iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);

try_page_again:

lock_sock(sk);

/* Sendmsg with $size size

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References