In the Linux kernel, the following vulnerability has been resolved:
atm: Revert atmaccounttx() if copyfromiter_full() fails.
In vccsendmsg(), we account skb->truesize to sk->skwmemalloc by atmaccount_tx().
It is expected to be reverted by atmpopraw() later called by vcc->dev->ops->send(vcc, skb).
However, vccsendmsg() misses the same revert when copyfromiterfull() fails, and then we will leak a socket.
Let's factorise the revert part as atmreturntx() and call it in the failure path.
Note that the corresponding skwmemalloc operation can be found in alloc_tx() as of the blamed commit.
$ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~
[ { "signature_type": "Function", "id": "CVE-2025-38190-00e31376", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-01098de3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@287b4f085d2ca3375cf1ee672af27410c64777e8", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-07c8ff42", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-0a06240f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-0dd0937d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-17185760", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-1b741e56", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-2f6ee082", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-3a81997e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-3b9daf2a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@287b4f085d2ca3375cf1ee672af27410c64777e8", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-4dc556f9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-4f87609d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-5b0186a1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-5f1417cf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-6b8ca559", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-71db04c7", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-71e8cef5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-740e6181", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@287b4f085d2ca3375cf1ee672af27410c64777e8", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-7949ee44", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-7c1ae304", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-81f2c07c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-85ed0d0f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-8fefa4ae", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-9f233ce6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-a58a172d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-affd168e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-b44e5ec1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@287b4f085d2ca3375cf1ee672af27410c64777e8", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-bb1492d2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-bbf86026", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-c9343104", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-d9616e17", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5", "signature_version": "v1", "target": { "file": "include/linux/atmdev.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "180683783681408117692106827230088484332", "86380866242754718316039502664249474649", "58449517257305160903643211736257621816" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-d9a47ffa", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-da060596", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-de8701fc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@287b4f085d2ca3375cf1ee672af27410c64777e8", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-dee8310f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d", "signature_version": "v1", "target": { "file": "net/atm/common.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "209311636269356392095842947299184747117", "333158299687999648531790829518924130321", "302016684551472105674517642990428314812", "316396928818982570669999227407091868938" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38190-df9f40cb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685", "signature_version": "v1", "target": { "file": "net/atm/raw.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "146249044011525173747425355544664248499", "163599427612367663516502652160592776504", "137023623159516402559341956609376977420", "80126150171998076907293514870017105533" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-ee971080", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-f0aa5b16", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5", "signature_version": "v1", "target": { "function": "atm_pop_raw", "file": "net/atm/raw.c" }, "digest": { "function_hash": "159226519197689517382123426061562447753", "length": 341.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-f0ed5e8e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38190-f1dbf93b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1", "signature_version": "v1", "target": { "function": "vcc_sendmsg", "file": "net/atm/common.c" }, "digest": { "function_hash": "121552784520119496538279264890549196940", "length": 1797.0 }, "deprecated": false } ]