CVE-2025-38124
Description
A denial of service vulnerability has been discovered in the Linux kernel's UDP Generic Segmentation Offload (GSO) functionality. This flaw allows a local, unprivileged user to trigger a kernel crash by generating UDP packets with a specially malformed frag_list geometry. Successful exploitation of this vulnerability could lead to a system crash, severely impacting the availability and stability of the affected system.
Statement
This vulnerability in the Linux kernel's UDP Generic Segmentation Offload (GSO) path allows specially crafted packets with malformed frag_list geometry to trigger a kernel BUG within the skb_segment() function. This occurs when only a portion of the packet data is pulled into the linear part of the SKB (Socket Buffer), violating assumptions made by the segmentation logic. If these malformed SKBs are not linearized, the kernel will crash due to invariant violations, leading to a denial-of-service.
While the CVSS privileges are rated as Low, meaning unprivileged users can potentially construct such malicious SKBs via AF_PACKET sockets, BPF hooks, or containerized networking interfaces, the impact remains a system-level denial of service.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | 5.5 | 7.5 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | High | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | None | None |
| Integrity Impact | High | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Other
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
