Tracker / CVE-2025-38190
CVE-2025-38190
Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However, vcc_sendmsg() misses the same revert when copy_from_iter_full() fails, and then we will leak a socket. Let's factorise the revert part as atm_return_tx() and call it in the failure path. Note that the corresponding sk_wmem_alloc operation can be found in alloc_tx() as of the blamed commit. $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~
Affected products and versions
| debian | debian_linux |
|---|---|
| linux | linux_kernel |
| linux | linux_kernel · 2.6.13 → 5.4.295 |
| linux | linux_kernel · 5.11 → 5.15.186 |
| linux | linux_kernel · 5.16 → 6.1.142 |
| linux | linux_kernel · 5.5 → 5.10.239 |
| linux | linux_kernel · 6.13 → 6.15.4 |
| linux | linux_kernel · 6.2 → 6.6.95 |
| linux | linux_kernel · 6.7 → 6.12.35 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.