CVE-2025-38465

What it actually does

The vulnerability permits integer wraparound in netlink socket sk_rmem_alloc tracking when SO_RCVBUFFORCE is set to INT_MAX, bypassing the receive buffer check and allowing unbounded skb allocations until OOM.

Why it matters to the business

Local attackers can trigger denial of service by exhausting system memory on affected Linux systems, disrupting services and requiring reboots or restarts; high prevalence in Linux environments increases exposure risk.

How an attack unfolds

An attacker creates a netlink socket, forces the receive buffer to INT_MAX via setsockopt, then floods the socket with messages; the flawed signed comparison allows sk_rmem_alloc to wrap around repeatedly without enforcement, consuming memory until the system OOMs. Related threat actors in Linux privilege escalation campaigns may chain this for further impact.

How to fix it

Upgrade the Linux kernel to a version containing commit 9da025150b7c14a8390fc06aea314c0a4011e82c or later; apply the fix that replaces the flawed check with atomic_add_return and unsigned comparison.

How to confirm the fix worked

Verify the running kernel includes the referenced commit; test by reproducing the ss -f netlink output before/after the fix to confirm Recv-Q values no longer wrap to negative numbers.

Typical attack path

1. Create a netlink socket as an unprivileged local user
2. Call setsockopt with SO_RCVBUFFORCE set to INT_MAX
3. Repeatedly send netlink messages to trigger skb allocations
4. Observe sk_rmem_alloc wraparound and memory exhaustion leading to OOM

How to detect it

Inspect ss or netlink socket statistics for abnormally large or negative Recv-Q values; correlate with sudden memory pressure events in system logs; review process activity creating netlink sockets.

What your security team should do

• Prioritize kernel upgrades on all production systems within the next maintenance window due to memory exhaustion risk
• Monitor netlink socket usage and system memory metrics for anomalous growth
• Restrict unprivileged netlink socket creation where feasible via LSM policies