In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcpcsend(). syzbot reported the splat below. [0] vccsendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcpcsend() accesses skb->data as struct atmtcphdr after checking if skb->len is 0, but it's not enough. Also, when skb->len == 0, skb and sk (vcc) were leaked because devkfreeskb() is not called and skwmemalloc adjustment is missing to revert atmaccounttx() in vccsendmsg(), which is expected to be done in atmpopraw(). Let's properly free skb with an invalid length in atmtcpcsend(). [0]: BUG: KMSAN: uninit-value in atmtcpcsend+0x255/0xed0 drivers/atm/atmtcp.c:294 atmtcpcsend+0x255/0xed0 drivers/atm/atmtcp.c:294 vccsendmsg+0xd7c/0xff0 net/atm/common.c:644 socksendmsgnosec net/socket.c:712 [inline] socksendmsg+0x330/0x3d0 net/socket.c:727 _syssendmsg+0x7e0/0xd80 net/socket.c:2566 syssendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmsg net/socket.c:2652 [inline] _dosyssendmsg net/socket.c:2657 [inline] _sesyssendmsg net/socket.c:2655 [inline] _x64syssendmsg+0x211/0x3e0 net/socket.c:2655 x64syscall+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xd9/0x210 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f Uninit was created at: slabpostallochook mm/slub.c:4154 [inline] slaballocnode mm/slub.c:4197 [inline] kmemcacheallocnodenoprof+0x818/0xf00 mm/slub.c:4249 kmallocreserve+0x13c/0x4b0 net/core/skbuff.c:579 _allocskb+0x347/0x7d0 net/core/skbuff.c:670 allocskb include/linux/skbuff.h:1336 [inline] vccsendmsg+0xb40/0xff0 net/atm/common.c:628 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg+0x330/0x3d0 net/socket.c:727 _syssendmsg+0x7e0/0xd80 net/socket.c:2566 _syssendmsg+0x271/0x3b0 net/socket.c:2620 _syssendmsg net/socket.c:2652 [inline] _dosyssendmsg net/socket.c:2657 [inline] _sesyssendmsg net/socket.c:2655 [inline] _x64syssendmsg+0x211/0x3e0 net/socket.c:2655 x64syscall+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xd9/0x210 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025