In the Linux kernel, the following vulnerability has been resolved:
net: gso: fix ownership in __udpgsosegment
In __udpgsosegment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skborphan) RIP: 0010:iprcvcore+0x8b2/0xca0 Call Trace: iprcv+0xab/0x6e0 __netifreceiveskb_onecore+0x168/0x1b0 processbacklog+0x384/0x1100 _napipoll.constprop.0+0xa1/0x370 netrxaction+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVSACTIONATTRUSERSPACE action precedes an OVSACTIONATTROUTPUT action:
Fix this by also removing the reference to the socket in __udpgsosegment.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21926.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21926.json"
[
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/udp_offload.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f28205ddb76e86cac418332e952241d85fed0dc",
"deprecated": false,
"digest": {
"line_hashes": [
"312245448300979883100013517345450560994",
"79379293583010074746577965662225645288",
"71714034935558499522898899996700996344",
"238298437270710885341875731284697873725",
"308240556222374020810771098989772497426",
"183378019468237966351630376328492012873",
"137489693591045668144707663182768902252",
"163676049478267000959321675340752462205",
"295989865526014948610707168231742434635"
],
"threshold": 0.9
},
"id": "CVE-2025-21926-76ea0ab6",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/udp_offload.c",
"function": "__udp_gso_segment"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f28205ddb76e86cac418332e952241d85fed0dc",
"deprecated": false,
"digest": {
"function_hash": "248768545621460208161806416467339814178",
"length": 1804.0
},
"id": "CVE-2025-21926-ddee0ac9",
"signature_type": "Function"
}
]