Answer in brief
CVE-2025-38165 records a High severity (CVSS 7.5) vulnerability in bpf, sockmap: Fix panic when calling skb_linearize. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=65ad600b9bde68d2d28709943ab00b51ca8f0a1d <4dba44333a11522df54b49aa1f2edfaf6ce35fc7 || >=923877254f002ae87d441382bb1096d9e773d56d <9718ba6490732dbe70190d42c21deb1440834402 || >=a454d84ee20baf7bd7be90721b9821f73c7d23d9 <db1d15a26f21f97459508c42ae87cabe8d3afc3b || >=a454d84ee20baf7bd7be90721b9821f73c7d23d9 <3d25fa2d7f127348c818e1dab9e58534f7ac56cc || >=a454d84ee20baf7bd7be90721b9821f73c7d23d9 <e9c1299d813fc04668042690f2c3cc76d013959a || >=a454d84ee20baf7bd7be90721b9821f73c7d23d9 <5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e || e6b5e47adb9166e732cdf7e6e034946e3f89f36d || >=5.15.189 <5.15.190 || >=6.1.54 <6.1.142 || >=6.5.4 <6.6 | 4dba44333a11522df54b49aa1f2edfaf6ce35fc7, 9718ba6490732dbe70190d42c21deb1440834402, db1d15a26f21f97459508c42ae87cabe8d3afc3b, 3d25fa2d7f127348c818e1dab9e58534f7ac56cc, e9c1299d813fc04668042690f2c3cc76d013959a, 5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e, 5.15.190, 6.1.142, 6.6 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Jul 3, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling skb_linearize The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Then a kernel panic was captured: ''' [ 657.460555] kernel BUG at net/core/skbuff.c:2178! [ 657.462680] Tainted: [W]=WARN [ 657.463287] Workqueue: events sk_psock_backlog ... [ 657.469610] <TASK> [ 657.469738] ? die+0x36/0x90 [ 657.469916] ? do_trap+0x1d0/0x270 [ 657.470118] ? pskb_expand_head+0x612/0xf40 [ 657.470376] ? pskb_expand_head+0x612/0xf40 [ 657.470620] ? do_error_trap+0xa3/0x170 [ 657.470846] ? pskb_expand_head+0x612/0xf40 [ 657.471092] ? handle_invalid_op+0x2c/0x40 [ 657.471335] ? pskb_expand_head+0x612/0xf40 [ 657.471579] ? exc_invalid_op+0x2d/0x40 [ 657.471805] ? asm_exc_invalid_op+0x1a/0x20 [ 657.472052] ? pskb_expand_head+0xd1/0xf40 [ 657.472292] ? pskb_expand_head+0x612/0xf40 [ 657.472540] ? lock_acquire+0x18f/0x4e0 [ 657.472766] ? find_held_lock+0x2d/0x110 [ 657.472999] ? __pfx_pskb_expand_head+0x10/0x10 [ 657.473263] ? __kmalloc_cache_noprof+0x5b/0x470 [ 657.473537] ? __pfx___lock_release.isra.0+0x10/0x10 [ 657.473826] __pskb_pull_tail+0xfd/0x1d20 [ 657.474062] ? __kasan_slab_alloc+0x4e/0x90 [ 657.474707] sk_psock_skb_ingress_enqueue+0x3bf/0x510 [ 657.475392] ? __kasan_kmalloc+0xaa/0xb0 [ 657.476010] sk_psock_backlog+0x5cf/0xd70 [ 657.476637] process_one_work+0x858/0x1a20 ''' The panic originates from the assertion BUG_ON(skb_shared(skb)) in skb_linearize(). A previous commit(see Fixes tag) introduced skb_get() to avoid race conditions between skb operations in the backlog and skb release in the recvmsg path. However, this caused the panic to always occur when skb_linearize is executed. The "--rx-strp 100000" parameter forces the RX path to use the strparser module which aggregates data until it reaches 100KB before calling sockmap logic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize. To fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue. ''' sk_psock_backlog: sk_psock_handle_skb skb_get(skb) <== we move it into 'sk_psock_skb_ingress_enqueue' sk_psock_skb_ingress____________ ↓ | | → sk_psock_skb_ingress_self | sk_psock_skb_ingress_enqueue sk_psock_verdict_apply_________________↑ skb_linearize ''' Note that for verdict_apply path, the skb_get operation is unnecessary so we add 'take_ref' param to control it's behavior.
Quoted source text, attributed separately from HOL analysis.