In the Linux kernel, the following vulnerability has been resolved:
net: gso: fix ownership in _udpgso_segment
In _udpgso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skborphan) RIP: 0010:iprcvcore+0x8b2/0xca0 Call Trace: iprcv+0xab/0x6e0 _netifreceiveskbonecore+0x168/0x1b0 processbacklog+0x384/0x1100 _napipoll.constprop.0+0xa1/0x370 netrxaction+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVSACTIONATTRUSERSPACE action precedes an OVSACTIONATTROUTPUT action:
Fix this by also removing the reference to the socket in _udpgso_segment.
[
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165880926910251874103275216463484228190",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-2187f25c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455217ac9db0cf9349b3933664355e907bb1a569",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"214667317471275262826792881343886682757",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-6193d63c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"214667317471275262826792881343886682757",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-6fc9be20",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee01b2f2d7d0010787c2343463965bbc283a497f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"312245448300979883100013517345450560994",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-76ea0ab6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f28205ddb76e86cac418332e952241d85fed0dc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"214667317471275262826792881343886682757",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-79cdfc6f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@084819b0d8b1bd433b90142371eb9450d657f8ca",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2909.0,
"function_hash": "251805932008477318442435525207663546214"
},
"id": "CVE-2025-21926-8a98a0e2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee01b2f2d7d0010787c2343463965bbc283a497f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2909.0,
"function_hash": "251805932008477318442435525207663546214"
},
"id": "CVE-2025-21926-91193f18",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@084819b0d8b1bd433b90142371eb9450d657f8ca",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"214667317471275262826792881343886682757",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-9550aaf5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a83237644d6822bc7df2c5564fc81b0df84358",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"312245448300979883100013517345450560994",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-b427423e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2d1cca955ed34873e524cc2e6e885450d262f05",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2229.0,
"function_hash": "125033651675558222220431025900010575757"
},
"id": "CVE-2025-21926-b7d35474",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455217ac9db0cf9349b3933664355e907bb1a569",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 1919.0,
"function_hash": "47140069660569088733154861015744726427"
},
"id": "CVE-2025-21926-c63e8154",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2d1cca955ed34873e524cc2e6e885450d262f05",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2720.0,
"function_hash": "44903818171548404422450396047148101190"
},
"id": "CVE-2025-21926-d7a1346d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01a83237644d6822bc7df2c5564fc81b0df84358",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2909.0,
"function_hash": "251805932008477318442435525207663546214"
},
"id": "CVE-2025-21926-da3ba44c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 1804.0,
"function_hash": "248768545621460208161806416467339814178"
},
"id": "CVE-2025-21926-ddee0ac9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f28205ddb76e86cac418332e952241d85fed0dc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"digest": {
"length": 2720.0,
"function_hash": "44903818171548404422450396047148101190"
},
"id": "CVE-2025-21926-ee011705",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8db70537878e1bb3fd83e5abcc6feefc0587828",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/ipv4/udp_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"214667317471275262826792881343886682757",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
]
},
"id": "CVE-2025-21926-efcef551",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8db70537878e1bb3fd83e5abcc6feefc0587828",
"signature_version": "v1"
}
]