In the Linux kernel, the following vulnerability has been resolved:
atm: atmtcp: Free invalid length skb in atmtcpcsend().
syzbot reported the splat below. [0]
vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send().
atmtcpcsend() accesses skb->data as struct atmtcp_hdr after checking if skb->len is 0, but it's not enough.
Also, when skb->len == 0, skb and sk (vcc) were leaked because devkfreeskb() is not called and skwmemalloc adjustment is missing to revert atmaccounttx() in vccsendmsg(), which is expected to be done in atmpop_raw().
Let's properly free skb with an invalid length in atmtcpcsend().
atmtcpcsend+0x255/0xed0 drivers/atm/atmtcp.c:294 vccsendmsg+0xd7c/0xff0 net/atm/common.c:644 socksendmsgnosec net/socket.c:712 [inline] socksendmsg+0x330/0x3d0 net/socket.c:727 syssendmsg+0x7e0/0xd80 net/socket.c:2566 _syssendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmsg net/socket.c:2652 [inline] _dosyssendmsg net/socket.c:2657 [inline] _sesyssendmsg net/socket.c:2655 [inline] _x64syssendmsg+0x211/0x3e0 net/socket.c:2655 x64syscall+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xd9/0x210 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
Uninit was created at: slabpostallochook mm/slub.c:4154 [inline] slaballocnode mm/slub.c:4197 [inline] kmemcacheallocnodenoprof+0x818/0xf00 mm/slub.c:4249 kmallocreserve+0x13c/0x4b0 net/core/skbuff.c:579 allocskb+0x347/0x7d0 net/core/skbuff.c:670 allocskb include/linux/skbuff.h:1336 [inline] vccsendmsg+0xb40/0xff0 net/atm/common.c:628 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg+0x330/0x3d0 net/socket.c:727 _syssendmsg+0x7e0/0xd80 net/socket.c:2566 _syssendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmsg net/socket.c:2652 [inline] _dosyssendmsg net/socket.c:2657 [inline] _sesyssendmsg net/socket.c:2655 [inline] _x64syssendmsg+0x211/0x3e0 net/socket.c:2655 x64syscall+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xd9/0x210 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[
{
"id": "CVE-2025-38185-6caab6a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4b0fd8c25a7583f8564af6cc910418fb8954e89",
"signature_version": "v1",
"target": {
"file": "drivers/atm/atmtcp.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"237718871295815322707227606351463319970",
"68107831573644690620263644952982514172",
"103085626953156532438885553447233472339",
"263729203273562384623906845397273921499"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38185-6efedb33",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4b0fd8c25a7583f8564af6cc910418fb8954e89",
"signature_version": "v1",
"target": {
"file": "drivers/atm/atmtcp.c",
"function": "atmtcp_c_send"
},
"deprecated": false,
"digest": {
"length": 990.0,
"function_hash": "207834397144336873507960933820171599553"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38185-749740af",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e996507f59610e5752b8702537f13f551e7a2c96",
"signature_version": "v1",
"target": {
"file": "drivers/atm/atmtcp.c",
"function": "atmtcp_c_send"
},
"deprecated": false,
"digest": {
"length": 990.0,
"function_hash": "207834397144336873507960933820171599553"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38185-d1b0505b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e996507f59610e5752b8702537f13f551e7a2c96",
"signature_version": "v1",
"target": {
"file": "drivers/atm/atmtcp.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"237718871295815322707227606351463319970",
"68107831573644690620263644952982514172",
"103085626953156532438885553447233472339",
"263729203273562384623906845397273921499"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]