CVE-2025-23138

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> watch_queue: fix pipe accounting mismatch<br /> <br /> Currently, watch_queue_set_size() modifies the pipe buffers charged to<br /> user-&gt;pipe_bufs without updating the pipe-&gt;nr_accounted on the pipe<br /> itself, due to the if (!pipe_has_watch_queue()) test in<br /> pipe_resize_ring(). This means that when the pipe is ultimately freed,<br /> we decrement user-&gt;pipe_bufs by something other than what than we had<br /> charged to it, potentially leading to an underflow. This in turn can<br /> cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.<br /> <br /> To remedy this, explicitly account for the pipe usage in<br /> watch_queue_set_size() to match the number set via account_pipe_buffers()<br /> <br /> (It&amp;#39;s unclear why watch_queue_set_size() does not update nr_accounted;<br /> it may be due to intentional overprovisioning in watch_queue_set_size()?)