In the Linux kernel, the following vulnerability has been resolved:
atm: Revert atmaccounttx() if copyfromiter_full() fails.
In vccsendmsg(), we account skb->truesize to sk->skwmemalloc by atmaccount_tx().
It is expected to be reverted by atmpopraw() later called by vcc->dev->ops->send(vcc, skb).
However, vccsendmsg() misses the same revert when copyfromiterfull() fails, and then we will leak a socket.
Let's factorise the revert part as atmreturntx() and call it in the failure path.
Note that the corresponding skwmemalloc operation can be found in alloc_tx() as of the blamed commit.
$ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~
[
{
"id": "CVE-2025-38190-00e31376",
"deprecated": false,
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-07c8ff42",
"deprecated": false,
"digest": {
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-17185760",
"deprecated": false,
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-1b741e56",
"deprecated": false,
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-2f6ee082",
"deprecated": false,
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-3a81997e",
"deprecated": false,
"digest": {
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-4dc556f9",
"deprecated": false,
"digest": {
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
],
"threshold": 0.9
},
"target": {
"file": "include/linux/atmdev.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-4f87609d",
"deprecated": false,
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-5f1417cf",
"deprecated": false,
"digest": {
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-6b8ca559",
"deprecated": false,
"digest": {
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/raw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-71e8cef5",
"deprecated": false,
"digest": {
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/raw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-7c1ae304",
"deprecated": false,
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-81f2c07c",
"deprecated": false,
"digest": {
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-85ed0d0f",
"deprecated": false,
"digest": {
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/raw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-8fefa4ae",
"deprecated": false,
"digest": {
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/raw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-9f233ce6",
"deprecated": false,
"digest": {
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
],
"threshold": 0.9
},
"target": {
"file": "include/linux/atmdev.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-a58a172d",
"deprecated": false,
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-affd168e",
"deprecated": false,
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-bbf86026",
"deprecated": false,
"digest": {
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
],
"threshold": 0.9
},
"target": {
"file": "include/linux/atmdev.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-c9343104",
"deprecated": false,
"digest": {
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
],
"threshold": 0.9
},
"target": {
"file": "include/linux/atmdev.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-d9616e17",
"deprecated": false,
"digest": {
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
],
"threshold": 0.9
},
"target": {
"file": "include/linux/atmdev.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-d9a47ffa",
"deprecated": false,
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38190-dee8310f",
"deprecated": false,
"digest": {
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/common.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2252c539c43f9a1431a7e8b34e3c18e9dd77a96d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-df9f40cb",
"deprecated": false,
"digest": {
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
],
"threshold": 0.9
},
"target": {
"file": "net/atm/raw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6bc28cfe5c8e3a279b4b4bdeed6698b2702685",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38190-f0aa5b16",
"deprecated": false,
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5",
"signature_version": "v1",
"signature_type": "Function"
}
]