CVE-2025-38463

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp: Correct signedness in skb remaining space calculation<br /> <br /> Syzkaller reported a bug [1] where sk-&gt;sk_forward_alloc can overflow.<br /> <br /> When we send data, if an skb exists at the tail of the write queue, the<br /> kernel will attempt to append the new data to that skb. However, the code<br /> that checks for available space in the skb is flawed:<br /> &amp;#39;&amp;#39;&amp;#39;<br /> copy = size_goal - skb-&gt;len<br /> &amp;#39;&amp;#39;&amp;#39;<br /> <br /> The types of the variables involved are:<br /> &amp;#39;&amp;#39;&amp;#39;<br /> copy: ssize_t (s64 on 64-bit systems)<br /> size_goal: int<br /> skb-&gt;len: unsigned int<br /> &amp;#39;&amp;#39;&amp;#39;<br /> <br /> Due to C&amp;#39;s type promotion rules, the signed size_goal is converted to an<br /> unsigned int to match skb-&gt;len before the subtraction. The result is an<br /> unsigned int.<br /> <br /> When this unsigned int result is then assigned to the s64 copy variable,<br /> it is zero-extended, preserving its non-negative value. Consequently, copy<br /> is always &gt;= 0.<br /> <br /> Assume we are sending 2GB of data and size_goal has been adjusted to a<br /> value smaller than skb-&gt;len. The subtraction will result in copy holding a<br /> very large positive integer. In the subsequent logic, this large value is<br /> used to update sk-&gt;sk_forward_alloc, which can easily cause it to overflow.<br /> <br /> The syzkaller reproducer uses TCP_REPAIR to reliably create this<br /> condition. However, this can also occur in real-world scenarios. The<br /> tcp_bound_to_half_wnd() function can also reduce size_goal to a small<br /> value. This would cause the subsequent tcp_wmem_schedule() to set<br /> sk-&gt;sk_forward_alloc to a value close to INT_MAX. Further memory<br /> allocation requests would then cause sk_forward_alloc to wrap around and<br /> become negative.<br /> <br /> [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47