{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38057", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.979Z", "datePublished": "2025-06-18T09:33:37.148Z", "dateUpdated": "2026-08-05T11:59:07.403Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:07.403Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: fix skb leaks\n\nA few error paths are missing a kfree_skb." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - espintcp exists specifically to carry IPsec over TCP across the public internet, and both leak triggers are driven by network events — a remote peer resetting/closing the espintcp TCP connection (making `inet_lookup_established` fail) and remotely induced outbound traffic volume that overflows `out_queue` past `net_hotdata.max_backlog`. The skbs are leaked in the network datapath from a softirq/workqueue re-injection context, with no local access required.\nAC:L - The attacker controls both trigger conditions directly — packet rate through the tunnel and the state of the espintcp TCP connection — and each qualifying packet leaks an skb deterministically with no memory-layout or timing requirement beyond the attacker's influence. The kernel discards the error return in `xfrm_trans_reinject()`, so the leak is guaranteed, not probabilistic.\nPR:N - No credentials on the target are needed: an unauthenticated remote host can send packets that elicit reply traffic routed out over the espintcp SA, and the remote TCP peer can tear down the espintcp connection at will. Locally the path is reachable by any unprivileged user simply sending traffic matching the IPsec policy.\nUI:N - The leak occurs entirely within kernel packet processing on the xfrm output path; no administrator or user action on the victim system is required once the espintcp SA is configured.\nS:U - The leaked memory and the resulting resource exhaustion are confined to the kernel's own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:N - The bug is a missing `kfree_skb()` — memory is simply never released. No stale or out-of-bounds data is read or exposed to the attacker, and no kernel addresses are disclosed.\nI:N - No memory corruption, out-of-bounds write, or type confusion occurs; the skb is never reused after the missed free, so there is no write primitive or data modification.\nA:H - This is an unbounded, attacker-rate-driven leak in the network fast path — with the espintcp socket gone, every outbound ESP packet permanently leaks a full skb, exhausting kernel memory and driving the system to OOM. The leaked skbs also retain their `dst_entry` (and thus netdev) references, which additionally pins device refcounts and can hang network-namespace teardown indefinitely." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/esp4.c", "net/ipv6/esp6.c", "net/xfrm/espintcp.c" ], "versions": [ { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "05db2b850a2b8b17f3d1799f563ea1d550e05ed5", "status": "affected", "versionType": "git" }, { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b", "status": "affected", "versionType": "git" }, { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "d8d79cf8c2b7475c22f9874eb844bcc80f858b13", "status": "affected", "versionType": "git" }, { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "28756f22de48d25256ed89234b66b9037a3f0157", "status": "affected", "versionType": "git" }, { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "eb058693dfc93ed7a9c365adb899fedd648b9d9f", "status": "affected", "versionType": "git" }, { "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593", "lessThan": "63c1f19a3be3169e51a5812d22a6d0c879414076", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/esp4.c", "net/ipv6/esp6.c", "net/xfrm/espintcp.c" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.199" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.159" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.14.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/05db2b850a2b8b17f3d1799f563ea1d550e05ed5" }, { "url": "https://git.kernel.org/stable/c/e2e1f50fc5ebd2826c4e8c558dc65434382d0c0b" }, { "url": "https://git.kernel.org/stable/c/d8d79cf8c2b7475c22f9874eb844bcc80f858b13" }, { "url": "https://git.kernel.org/stable/c/28756f22de48d25256ed89234b66b9037a3f0157" }, { "url": "https://git.kernel.org/stable/c/eb058693dfc93ed7a9c365adb899fedd648b9d9f" }, { "url": "https://git.kernel.org/stable/c/63c1f19a3be3169e51a5812d22a6d0c879414076" } ], "title": "espintcp: fix skb leaks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2025-38057", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2026-06-10T20:40:52.542424Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:06.505Z" } } ] } }