CVE-2025-4948

What it actually does

Integer underflow in soup_multipart_new_from_message() when processing specially crafted multipart messages due to improper validation, resulting in invalid memory access and application crash.

Why it matters to the business

Services and applications relying on libsoup on affected Ubuntu systems can be forced offline unexpectedly, disrupting availability and requiring restarts or failover handling.

How an attack unfolds

An attacker crafts a malicious multipart HTTP message and sends it to any network-reachable application or server that uses the vulnerable libsoup library; the malformed input triggers the underflow during parsing, causing the process to crash and resulting in denial of service.

How to fix it

Upgrade affected packages to the fixed versions: linux (Ubuntu 24.04 LTS) to 6.8.0-50.51 or later, linux-aws (Ubuntu 24.04 LTS) to 6.8.0-1020.22 or later, and linux-azure (Ubuntu 24.04 LTS) to 6.8.0-1020.23 or later. Apply updates via standard package management and restart affected services.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases, then test with known-good and crafted multipart requests to confirm the application no longer crashes on malformed input.

Typical attack path

1. Identify a target application or server using the vulnerable libsoup library
2. Craft a specially malformed multipart message that triggers the integer underflow
3. Transmit the message over HTTP to the target
4. Observe the resulting crash and service interruption

How to detect it

Review application and system logs for unexpected crashes or segmentation faults occurring shortly after receipt of HTTP requests containing multipart content; correlate with web server access logs showing unusual multipart payloads.

What your security team should do

• Apply the listed kernel package updates immediately across all affected Ubuntu 24.04 LTS systems
• Prioritize internet-facing services that handle HTTP multipart content
• Monitor for application crashes correlated with incoming HTTP traffic until patches are deployed