CVE-2025-23138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23138
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23138.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-23138
Downstream
Related
Published
2025-04-16T14:13:17.866Z
Modified
2026-03-20T12:41:21.583716Z
Summary
watch_queue: fix pipe accounting mismatch
Details

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: fix pipe accounting mismatch

Currently, watchqueuesetsize() modifies the pipe buffers charged to user->pipebufs without updating the pipe->nraccounted on the pipe itself, due to the if (!pipehaswatchqueue()) test in piperesizering(). This means that when the pipe is ultimately freed, we decrement user->pipebufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent toomanypipebuffers_soft() tests to fail with -EPERM.

To remedy this, explicitly account for the pipe usage in watchqueuesetsize() to match the number set via accountpipe_buffers()

(It's unclear why watchqueuesetsize() does not update nraccounted; it may be due to intentional overprovisioning in watchqueueset_size()?)

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23138.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8
Fixed
8658c75343ed00e5e154ebbe24335f51ba8db547
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3efbd114b91525bb095b8ae046382197d92126b9
Fixed
471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b87a1229d8668fbc78ebd9ca0fc797a76001c60f
Fixed
d40e3537265dea9e3c33021874437ff26dc18787
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68e51bdb1194f11d3452525b99c98aff6f837b24
Fixed
6dafa27764183738dc5368b669b71e3d0d154f12
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e95aada4cb93d42e25c30a0ef9eb2923d9711d4a
Fixed
56ec918e6c86c1536870e4373e91eddd0c44245f
Fixed
2d680b988656bb556c863d8b46d9b9096842bf3d
Fixed
205028ebba838938d3b264dda1d0708fa7fe1ade
Fixed
f13abc1e8e1a3b7455511c4e122750127f6bc9b0
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6fb70694f8d1ac34e45246b0ac988f025e1e5b55

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23138.json"