Linux Kernel Socket Memory Leak Vulnerability in Affected Systems

CVE-2025-38190

What is CVE-2025-38190?

A vulnerability has been identified in the Linux kernel's handling of socket memory, specifically relating to the accounting of skb->truesize during the vcc_sendmsg() function. If the copy_from_iter_full() operation fails, the revert mechanism is not triggered, leading to a potential memory leak of socket resources. This oversight can allow for improper memory utilization, which may be exploited in specific scenarios. A dedicated revert function, atm_return_tx(), has been proposed to ensure that the socket resources are properly managed, mitigating the risk of memory leaks.

References