{"id":"DEBIAN-CVE-2025-38165","details":"In the Linux kernel, the following vulnerability has been resolved:  bpf, sockmap: Fix panic when calling skb_linearize  The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000  Then a kernel panic was captured: ''' [  657.460555] kernel BUG at net/core/skbuff.c:2178! [  657.462680] Tainted: [W]=WARN [  657.463287] Workqueue: events sk_psock_backlog ... [  657.469610]  \u003cTASK\u003e [  657.469738]  ? die+0x36/0x90 [  657.469916]  ? do_trap+0x1d0/0x270 [  657.470118]  ? pskb_expand_head+0x612/0xf40 [  657.470376]  ? pskb_expand_head+0x612/0xf40 [  657.470620]  ? do_error_trap+0xa3/0x170 [  657.470846]  ? pskb_expand_head+0x612/0xf40 [  657.471092]  ? handle_invalid_op+0x2c/0x40 [  657.471335]  ? pskb_expand_head+0x612/0xf40 [  657.471579]  ? exc_invalid_op+0x2d/0x40 [  657.471805]  ? asm_exc_invalid_op+0x1a/0x20 [  657.472052]  ? pskb_expand_head+0xd1/0xf40 [  657.472292]  ? pskb_expand_head+0x612/0xf40 [  657.472540]  ? lock_acquire+0x18f/0x4e0 [  657.472766]  ? find_held_lock+0x2d/0x110 [  657.472999]  ? __pfx_pskb_expand_head+0x10/0x10 [  657.473263]  ? __kmalloc_cache_noprof+0x5b/0x470 [  657.473537]  ? __pfx___lock_release.isra.0+0x10/0x10 [  657.473826]  __pskb_pull_tail+0xfd/0x1d20 [  657.474062]  ? __kasan_slab_alloc+0x4e/0x90 [  657.474707]  sk_psock_skb_ingress_enqueue+0x3bf/0x510 [  657.475392]  ? __kasan_kmalloc+0xaa/0xb0 [  657.476010]  sk_psock_backlog+0x5cf/0xd70 [  657.476637]  process_one_work+0x858/0x1a20 '''  The panic originates from the assertion BUG_ON(skb_shared(skb)) in skb_linearize(). A previous commit(see Fixes tag) introduced skb_get() to avoid race conditions between skb operations in the backlog and skb release in the recvmsg path. However, this caused the panic to always occur when skb_linearize is executed.  The \"--rx-strp 100000\" parameter forces the RX path to use the strparser module which aggregates data until it reaches 100KB before calling sockmap logic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize.  To fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue.  ''' sk_psock_backlog:     sk_psock_handle_skb        skb_get(skb) \u003c== we move it into 'sk_psock_skb_ingress_enqueue'        sk_psock_skb_ingress____________                                        ↓                                        |                                        | → sk_psock_skb_ingress_self                                        |      sk_psock_skb_ingress_enqueue sk_psock_verdict_apply_________________↑          skb_linearize '''  Note that for verdict_apply path, the skb_get operation is unnecessary so we add 'take_ref' param to control it's behavior.","modified":"2026-09-01T16:06:13.945455226Z","published":"2025-07-03T09:15:31.990Z","upstream":["CVE-2025-38165"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38165"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.147-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38165.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38165.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38165.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}