CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-01 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug: kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan) RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50 The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action: 1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path. 4. If it later hits skb_orphan, we hit the bug. Fix this by also removing the reference to the socket in __udp_gso_segment.

Affected products

Linux kernel: from 4.18 before 5.4.291; from 5.5 before 5.10.235; from 5.11 before 5.15.179; from 5.16 before 6.1.131; from 6.2 before 6.6.83; from 6.7 before 6.12.19 — fixed in 5.10.235, 5.15.179, 5.4.291, 6.1.131, 6.12.19, 6.13.7

How to fix

Upgrade to a fixed version: Linux kernel 5.10.235, 5.15.179, 5.4.291, 6.1.131. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-21926 or the next vulnerability affects your stack