CVE-2025-38124 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
net: fix udp gso skb_segment after pull from frag_list
Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust.
If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below.
Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size
Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants.
In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes.
The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearized before pass to regular skb_segment.
skb_segment+0xcd0/0xd14 __udp_gso_segment+0x334/0x5f4 udp4_ufo_fragment+0x118/0x15c inet_gso_segment+0x164/0x338 skb_mac_gso_segment+0xc4/0x13c __skb_gso_segment+0xc4/0x124 validate_xmit_skb+0x9c/0x2c0 validate_xmit_skb_list+0x4c/0x80 sch_direct_xmit+0x70/0x404 __dev_queue_xmit+0x64c/0xe5c neigh_resolve_output+0x178/0x1c4 ip_finish_output2+0x37c/0x47c __ip_finish_output+0x194/0x240 ip_finish_output+0x20/0xf4 ip_output+0x100/0x1a0 NF_HOOK+0xc4/0x16c ip_forward+0x314/0x32c ip_rcv+0x90/0x118 __netif_receive_skb+0x74/0x124 process_backlog+0xe8/0x1a4 __napi_poll+0x5c/0x1f8 net_rx_action+0x154/0x314 handle_softirqs+0x154/0x4b8
[118.376811] [C201134] rxq0_pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278!
[118.376829] [C201134] rxq0_pus: [name:traps&]Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[118.470774] [C201134] rxq0_pus: [name:mrdump&]Kernel Offset: 0x178cc00000 from 0xffffffc008000000
[118.470810] [C201134] rxq0_pus: [name:mrdump&]PHYS_OFFSET: 0x40000000
[118.470827] [C201134] rxq0_pus: [name:mrdump&]pstate: 60400005 (nZCv daif +PAN -UAO)
[118.470848] [C201134] rxq0_pus: [name:mrdump&]pc : [0xffffffd79598aefc] skb_segment+0xcd0/0xd14
[118.470900] [C201134] rxq0_pus: [name:mrdump&]lr : [0xffffffd79598a5e8] skb_segment+0x3bc/0xd14
[118.470928] [C201134] rxq0_pus: [name:mrdump&]sp : ffffffc008013770
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified as CVE-2025-38124 affects the Linux kernel's network stack, specifically within the handling of Generic Segmentation Offload (GSO) for User Datagram Protocol (UDP) packets. This issue arises from improper management of sk_buff (skb) structures when processing fragmented packets that utilize the frag_list mechanism. The core flaw manifests when optional datapath hooks such as Network Address Translation (NAT) or Berkeley Packet Filter (BPF) modify the geometry of frag_list skbs, causing them to violate fundamental invariants required for proper GSO processing. According to CWE-129, this represents an out-of-bounds read vulnerability that occurs due to incorrect validation of data structures during network packet processing. The problem is particularly severe because it can lead to kernel crashes and system instability when the kernel attempts to segment packets that no longer conform to expected structural requirements.
The technical implementation of the fix addresses the root cause by implementing a more robust approach to handling malformed frag_list skbs. Instead of attempting to patch each specific case of geometry violation within the complex skb_segment code, the solution linearizes all affected packets before passing them to the regular segmentation routine. This approach aligns with ATT&CK technique T1059.005, which involves modifying system behavior through kernel-level code changes. The vulnerability specifically impacts the UDP GSO fragmentation path where packets with modified frag_list geometry cause the skb_segment function to fail during the segmentation process. The call stack shows the failure occurring deep within the network processing pipeline, starting from the UDP GSO segmenter and propagating through multiple kernel subsystems including IP output and network interface handling. The crash occurs at net/core/skbuff.c line 4278, indicating a kernel BUG due to invalid memory access patterns when attempting to process the corrupted skb structure.
The operational impact of this vulnerability extends beyond simple packet processing failures, potentially enabling denial of service attacks against systems running affected Linux kernels. Attackers could craft specific UDP packets that, when processed through network hooks such as NAT or BPF programs, would trigger the kernel bug and cause system crashes or reboots. The vulnerability affects systems that rely heavily on network virtualization, containerization, or network security appliances where BPF programs are commonly used for packet inspection and modification. The fix ensures that all frag_list skbs that fail basic invariants are linearized, preventing the kernel from attempting to process malformed structures that could lead to memory corruption or kernel panics. This remediation approach provides better stability and security by eliminating the complex conditional logic that previously attempted to handle edge cases in the skb_segment code. The solution also helps maintain compatibility with various network processing modules while ensuring that the kernel's network stack remains robust against malformed packet inputs that could be introduced through legitimate network operations or malicious packet crafting.