CVE-2025-38463

In the Linux kernel, the following vulnerability has been resolved:

tcp: Correct signedness in skb remaining space calculation

Syzkaller reported a bug [1] where sk->skforwardalloc can overflow.

When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal - skb->len '''

The types of the variables involved are: ''' copy: ssizet (s64 on 64-bit systems) sizegoal: int skb->len: unsigned int '''

Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int.

When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0.

Assume we are sending 2GB of data and sizegoal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->skforward_alloc, which can easily cause it to overflow.

The syzkaller reproducer uses TCPREPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcpboundtohalfwnd() function can also reduce sizegoal to a small value. This would cause the subsequent tcpwmemschedule() to set sk->skforwardalloc to a value close to INTMAX. Further memory allocation requests would then cause skforward_alloc to wrap around and become negative.