In the Linux kernel, the following vulnerability has been resolved:
atm: Revert atmaccounttx() if copyfromiter_full() fails.
In vccsendmsg(), we account skb->truesize to sk->skwmemalloc by atmaccount_tx().
It is expected to be reverted by atmpopraw() later called by vcc->dev->ops->send(vcc, skb).
However, vccsendmsg() misses the same revert when copyfromiterfull() fails, and then we will leak a socket.
Let's factorise the revert part as atmreturntx() and call it in the failure path.
Note that the corresponding skwmemalloc operation can be found in alloc_tx() as of the blamed commit.
$ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~
[
{
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"signature_type": "Function",
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"id": "CVE-2025-38190-00e31376",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739"
},
{
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"signature_type": "Function",
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"id": "CVE-2025-38190-0a06240f",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1"
},
{
"target": {
"file": "net/atm/common.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
]
},
"id": "CVE-2025-38190-0dd0937d",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e"
},
{
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"signature_type": "Function",
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"id": "CVE-2025-38190-17185760",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739"
},
{
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"signature_type": "Function",
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"id": "CVE-2025-38190-2f6ee082",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859"
},
{
"target": {
"file": "net/atm/common.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
]
},
"id": "CVE-2025-38190-3a81997e",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739"
},
{
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"signature_type": "Function",
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"id": "CVE-2025-38190-4f87609d",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859"
},
{
"target": {
"file": "include/linux/atmdev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
]
},
"id": "CVE-2025-38190-5b0186a1",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1"
},
{
"target": {
"file": "net/atm/common.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
]
},
"id": "CVE-2025-38190-5f1417cf",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5"
},
{
"target": {
"file": "net/atm/raw.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
]
},
"id": "CVE-2025-38190-6b8ca559",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859"
},
{
"target": {
"file": "net/atm/raw.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
]
},
"id": "CVE-2025-38190-71db04c7",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e"
},
{
"target": {
"file": "net/atm/common.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
]
},
"id": "CVE-2025-38190-7949ee44",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1"
},
{
"target": {
"file": "net/atm/common.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209311636269356392095842947299184747117",
"333158299687999648531790829518924130321",
"302016684551472105674517642990428314812",
"316396928818982570669999227407091868938"
]
},
"id": "CVE-2025-38190-81f2c07c",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859"
},
{
"target": {
"file": "net/atm/raw.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
]
},
"id": "CVE-2025-38190-85ed0d0f",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739"
},
{
"target": {
"file": "net/atm/raw.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
]
},
"id": "CVE-2025-38190-8fefa4ae",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5"
},
{
"target": {
"file": "include/linux/atmdev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
]
},
"id": "CVE-2025-38190-9f233ce6",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d828519bd69bfcaabdd942a872679617ef06739"
},
{
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"signature_type": "Function",
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"id": "CVE-2025-38190-affd168e",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5"
},
{
"target": {
"file": "include/linux/atmdev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
]
},
"id": "CVE-2025-38190-bb1492d2",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e"
},
{
"target": {
"file": "include/linux/atmdev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
]
},
"id": "CVE-2025-38190-bbf86026",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7851263998d4269125fd6cb3fdbfc7c6db853859"
},
{
"target": {
"file": "include/linux/atmdev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180683783681408117692106827230088484332",
"86380866242754718316039502664249474649",
"58449517257305160903643211736257621816"
]
},
"id": "CVE-2025-38190-d9616e17",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5"
},
{
"target": {
"file": "net/atm/raw.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146249044011525173747425355544664248499",
"163599427612367663516502652160592776504",
"137023623159516402559341956609376977420",
"80126150171998076907293514870017105533"
]
},
"id": "CVE-2025-38190-da060596",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1"
},
{
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"signature_type": "Function",
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"id": "CVE-2025-38190-ee971080",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e"
},
{
"target": {
"file": "net/atm/raw.c",
"function": "atm_pop_raw"
},
"signature_type": "Function",
"digest": {
"length": 341.0,
"function_hash": "159226519197689517382123426061562447753"
},
"id": "CVE-2025-38190-f0aa5b16",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3902205eadf35db59dbc2186c2a98b9e6182efa5"
},
{
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"signature_type": "Function",
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"id": "CVE-2025-38190-f0ed5e8e",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0d00992118e234ebf29d5145c1cc920342777e"
},
{
"target": {
"file": "net/atm/common.c",
"function": "vcc_sendmsg"
},
"signature_type": "Function",
"digest": {
"length": 1797.0,
"function_hash": "121552784520119496538279264890549196940"
},
"id": "CVE-2025-38190-f1dbf93b",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c12430edd92fd49a4800b0f3fb395b50cb16bcc1"
}
]