net: fix udp gso skb_segment after pull from frag_list
In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearize
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.142, 6.12.34, 6.15.3, 6.6.94
- CVEs
- CVE-2025-38124
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 16:31 UTC · Revision 1
Source evidence
net: fix udp gso skb_segment after pull from frag_list
core-osv · Original sourcePublished 3 Jul 2025, 08:35 UTC
In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearize
osv:CVE-2025-38124
Kernel
Fixed versions: 6.1.142, 6.6.94, 6.12.34, 6.15.3
Complete source record
{
"id": "a3572a56255fccea20549f50d49fc2ef1f957814acda294971d7794cc3f77ce3",
"url": "https://osv.dev/vulnerability/CVE-2025-38124",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "net: fix udp gso skb_segment after pull from frag_list",
"summary": "In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 (\"net: gso: fix udp gso fraglist segmentation after pull from frag_list\") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearize",
"evidence": "osv:CVE-2025-38124",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.142",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.94",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.34",
"evidence": "/affected/1/ranges"
},
{
"value": "6.15.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-38124",
"aliases": [
"CVE-2025-38124"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "080e6c9a3908de193a48f646c5ce1bfb15676ffc"
},
{
"fixed": "0e65f38bd1aa14ea86e221b7bb814d38278d86c3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "af3122f5fdc0d00581d6e598a668df6bf54c9daa"
},
{
"fixed": "85eef1748c024da1a191aed56b30a3a65958c50c"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab"
},
{
"fixed": "4399f59a9467a324ed46657555f0e1f209a14acb"
},
{
"fixed": "a04302867094bdc6efac1b598370fc47cf3f2388"
},
{
"fixed": "3382a1ed7f778db841063f5d7e317ac55f9e7f72"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.113"
},
{
"fixed": "6.1.142"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.55"
},
{
"fixed": "6.6.94"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.10.14"
},
{
"fixed": "6.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.11.3"
},
{
"fixed": "6.12"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "33e28acf42ee863f332a958bfc2f1a284a3659df"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3cd00d2e3655fad3bda96dc1ebf17b6495f86fea"
}
]
}
],
"versions": [
"v6.1.141",
"v6.1.140",
"v6.1.139",
"v6.1.138",
"v6.1.137",
"v6.1.136",
"v6.1.135",
"v6.1.134",
"v6.1.133",
"v6.1.132",
"v6.1.131",
"v6.1.130",
"v6.1.129",
"v6.1.128",
"v6.1.127",
"v6.1.126",
"v6.1.125",
"v6.1.124",
"v6.1.123",
"v6.1.122",
"v6.1.121",
"v6.1.120",
"v6.1.119",
"v6.1.118",
"v6.1.117",
"v6.1.116",
"v6.1.115",
"v6.1.114",
"v6.1.113",
"v6.6.93",
"v6.6.92",
"v6.6.91",
"v6.6.90",
"v6.6.89",
"v6.6.88",
"v6.6.87",
"v6.6.86",
"v6.6.85",
"v6.6.84",
"v6.6.83",
"v6.6.82",
"v6.6.81",
"v6.6.80",
"v6.6.79",
"v6.6.78",
"v6.6.77",
"v6.6.76",
"v6.6.75",
"v6.6.74",
"v6.6.73",
"v6.6.72",
"v6.6.71",
"v6.6.70",
"v6.6.69",
"v6.6.68",
"v6.6.67",
"v6.6.66",
"v6.6.65",
"v6.6.64",
"v6.6.63",
"v6.6.62",
"v6.6.61",
"v6.6.60",
"v6.6.59",
"v6.6.58",
"v6.6.57",
"v6.6.56",
"v6.6.55",
"v6.10.14",
"v6.11.11",
"v6.11.10",
"v6.11.9",
"v6.11.8",
"v6.11.7",
"v6.11.6",
"v6.11.5",
"v6.11.4",
"v6.11.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38124.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.142"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.94"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.34"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.12.0"
},
{
"fixed": "6.15.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38124.json"
}
}
],
"modified": "2026-10-28T02:30:30.811489613Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"https://git.kernel.org/stable/c/0e65f38bd1aa14ea86e221b7bb814d38278d86c3",
"https://git.kernel.org/stable/c/3382a1ed7f778db841063f5d7e317ac55f9e7f72",
"https://git.kernel.org/stable/c/4399f59a9467a324ed46657555f0e1f209a14acb",
"https://git.kernel.org/stable/c/85eef1748c024da1a191aed56b30a3a65958c50c",
"https://git.kernel.org/stable/c/a04302867094bdc6efac1b598370fc47cf3f2388",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38124.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-38124",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38124.json"
}
},
"related_cves": [
{
"value": "CVE-2025-38124",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497416,
"published_at": "2025-07-03T08:35:30.499+00:00"
}