Use-Of-Uninitialized-Memory Vulnerability in Linux Kernel

CVE-2025-38718

What is CVE-2025-38718?

A vulnerability in the Linux kernel stemming from improper handling of cloned GSO packets in SCTP (Stream Control Transmission Protocol) can lead to the use of uninitialized memory. The issue arises when a cloned head socket buffer (skb) shares fragmentation skbs with the original skb. This incorrect handling can be exploited, resulting in memory access violations and potential data leakage. The issue has been reported by syzbot, and resolving it involves linearizing these cloned packets in the sctp_rcv function to ensure safe memory access.

References