CVE-2025-38190

What it actually does

Failure to revert sk_wmem_alloc accounting after atm_account_tx() when copy_from_iter_full() fails in vcc_sendmsg() leaves socket memory accounting permanently incremented, leaking socket resources.

Why it matters to the business

Gradual resource exhaustion on systems using ATM networking can lead to degraded performance or denial of service in long-running kernel environments, increasing operational overhead for affected Linux deployments.

How an attack unfolds

An attacker with local access sends specially crafted messages via vcc_sendmsg that trigger copy_from_iter_full failure after the initial accounting call, preventing the expected revert and accumulating un-reclaimed socket allocations over repeated attempts.

How to fix it

Update to fixed kernel commit 5e0d00992118e234ebf29d5145c1cc920342777e or later; for Chainguard packages upgrade kubernetes-csi-external-snapshotter-fips-8.2 and kubernetes-csi-external-snapshot-controller-fips-8.2 to 8.2.1-r5 or newer. Disable ATM if unused.

How to confirm the fix worked

Verify running kernel contains commit 5e0d00992118e234ebf29d5145c1cc920342777e via git log or uname; confirm Chainguard package versions match 8.2.1-r5 or above; test vcc_sendmsg failure paths do not increment sk_wmem_alloc permanently.

Typical attack path

1. Obtain local access or container context on a vulnerable Linux kernel with ATM enabled
2. Invoke vcc_sendmsg with data that causes copy_from_iter_full to fail after atm_account_tx
3. Repeat to accumulate leaked sk_wmem_alloc entries without triggering atm_pop_raw
4. Monitor for socket accounting exhaustion or related kernel memory pressure

How to detect it

Review kernel logs for repeated ATM sendmsg failures, monitor sk_wmem_alloc growth via /proc/net/sockstat or slabinfo, and inspect for processes repeatedly triggering vcc_sendmsg error paths without corresponding pops.

What your security team should do

• Prioritize patching kernel and listed Chainguard packages within standard maintenance windows given low EPSS
• Audit systems for ATM usage and disable the module if not required
• Monitor kernel memory and socket accounting metrics for anomalous growth
• Review container workloads for exposure to the affected kernel versions