CVE-2025-23138

What it actually does

A mismatch in pipe buffer accounting occurs because watch_queue_set_size() modifies user->pipe_bufs without updating pipe->nr_accounted when pipe_has_watch_queue() is false in pipe_resize_ring(), causing underflow on pipe free and subsequent too_many_pipe_buffers_soft() failures returning -EPERM.

Why it matters to the business

Legitimate applications and system services on Linux may unexpectedly fail when creating pipes, leading to operational disruptions, reduced availability, and potential need for restarts or workarounds on unpatched kernels.

How an attack unfolds

An attacker with local access triggers watch_queue_set_size() to create an accounting mismatch, then performs repeated pipe allocations and frees to induce underflow; this can cause denial of service by blocking further pipe creation for the user, though no public exploitation or specific threat actors have been tied to this issue.

How to fix it

Upgrade the Linux kernel to at least version 5.10.236 or apply the patch corresponding to commit 8658c75343ed00e5e154ebbe24335f51ba8db547 from stable trees; update affected Red Hat packages such as gstreamer1-plugins-base to 0:1.16.1-3.el8_6 where listed.

How to confirm the fix worked

Confirm the running kernel reports version 5.10.236 or newer and contains the referenced commit; exercise watch_queue and pipe operations in a test environment to verify no EPERM errors occur on subsequent allocations.

Typical attack path

1. Obtain local user access on affected Linux kernel
2. Invoke watch_queue operations to resize pipe rings
3. Trigger pipe allocation and deallocation sequences
4. Observe or force subsequent pipe creation attempts to fail with EPERM

How to detect it

Inspect kernel logs and audit records for repeated EPERM errors during pipe creation following watch_queue activity; examine user pipe buffer counters via /proc or debug interfaces for unexpected underflow conditions.

What your security team should do

• Apply kernel updates to 5.10.236 or later across all Linux deployments as soon as possible
• Review and test pipe-dependent workloads after patching
• Monitor kernel changelogs for related accounting fixes in other stable branches