{"id":"CVE-2025-21926","revision":"0118b8468ab2499089bbc8d110adf9ad","records":[{"revision":"0118b8468ab2499089bbc8d110adf9ad","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21926","aliases":[],"title":"net: gso: fix ownership in __udp_gso_segment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: fix ownership in __udp_gso_segment\n\nIn __udp_gso_segment the skb destructor is removed before segmenting the\nskb but the socket reference is kept as-is. This is an issue if the\noriginal skb is later orphaned as we can hit the following bug:\n\n kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan)\n RIP: 0010:ip_rcv_core+0x8b2/0xca0\n Call Trace:\n ip_rcv+0xab/0x6e0\n __netif_receive_skb_one_core+0x168/0x1b0\n process_backlog+0x384/0x1100\n __napi_poll.constprop.0+0xa1/0x370\n net_rx_action+0x925/0xe50\n\nThe above can happen following a sequence of events when using\nOpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an\nOVS_ACTION_ATTR_OUTPUT action:\n\n1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb\n goes through queue_gso_packets and then __udp_gso_segment, where its\n destructor is removed.\n2. The segments' data are copied and sent to userspace.\n3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the\n same original skb is sent to its path.\n4. If it later hits skb_orphan, we hit the bug.\n\nFix this by also removing the reference to the socket in\n__udp_gso_segment.","state":0,"publishedAt":"2025-04-01T15:40:57.882+00:00","modifiedAt":"2026-10-15T01:05:12.371+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/udp_offload.c\"\n ],\n \"versions\": [\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"9f28205ddb76e86cac418332e952241d85fed0dc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"a2d1cca955ed34873e524cc2e6e885450d262f05\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"455217ac9db0cf9349b3933664355e907bb1a569\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"e8db70537878e1bb3fd83e5abcc6feefc0587828\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"01a83237644d6822bc7df2c5564fc81b0df84358\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"084819b0d8b1bd433b90142371eb9450d657f8ca\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ad405857b174ed31a97982bb129c320d03321cf5\",\n \"lessThan\": \"ee01b2f2d7d0010787c2343463965bbc283a497f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/udp_offload.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.18\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.18\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.291\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.235\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.179\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.131\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.83\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.19\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.13.7\",\n \"lessThanOrEqual\": \"6.13.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.14\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/9f28205ddb76e86cac418332e952241d85fed0dc","https://git.kernel.org/stable/c/a2d1cca955ed34873e524cc2e6e885450d262f05","https://git.kernel.org/stable/c/455217ac9db0cf9349b3933664355e907bb1a569","https://git.kernel.org/stable/c/e8db70537878e1bb3fd83e5abcc6feefc0587828","https://git.kernel.org/stable/c/01a83237644d6822bc7df2c5564fc81b0df84358","https://git.kernel.org/stable/c/084819b0d8b1bd433b90142371eb9450d657f8ca","https://git.kernel.org/stable/c/c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b","https://git.kernel.org/stable/c/ee01b2f2d7d0010787c2343463965bbc283a497f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21926","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21926","identifiers":["CVE-2025-21926"]},"retained":false,"historicalAffected":[]}],"coverage":[]}