Bug 2393507 (CVE-2025-39718) - CVE-2025-39718 kernel: vsock/virtio: Validate length in packet header before skb_put()
Summary: CVE-2025-39718 kernel: vsock/virtio: Validate length in packet header before ...
Keywords:
Status: NEW
Alias: CVE-2025-39718
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-09-05 18:03 UTC by OSIDB Bzimport
Modified: 2025-11-17 00:45 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:19104 0 None None None 2025-10-27 16:19:24 UTC
Red Hat Product Errata RHSA-2025:19105 0 None None None 2025-10-27 19:34:10 UTC
Red Hat Product Errata RHSA-2025:19106 0 None None None 2025-10-27 18:31:38 UTC
Red Hat Product Errata RHSA-2025:21112 0 None None None 2025-11-12 11:25:12 UTC
Red Hat Product Errata RHSA-2025:21118 0 None None None 2025-11-12 12:22:10 UTC
Red Hat Product Errata RHSA-2025:21397 0 None None None 2025-11-17 00:35:59 UTC
Red Hat Product Errata RHSA-2025:21398 0 None None None 2025-11-17 00:45:23 UTC

Description OSIDB Bzimport 2025-09-05 18:03:01 UTC 
In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Validate length in packet header before skb_put()

When receiving a vsock packet in the guest, only the virtqueue buffer
size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
virtio_vsock_skb_rx_put() uses the length from the packet header as the
length argument to skb_put(), potentially resulting in SKB overflow if
the host has gone wonky.

Validate the length as advertised by the packet header before calling
virtio_vsock_skb_rx_put().
Comment 1 Jon Moroney 2025-09-05 21:40:57 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025090551-CVE-2025-39718-2e2c@gregkh/T
Comment 5 errata-xmlrpc 2025-10-27 16:19:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:19104 https://access.redhat.com/errata/RHSA-2025:19104
Comment 6 errata-xmlrpc 2025-10-27 18:31:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:19106 https://access.redhat.com/errata/RHSA-2025:19106
Comment 7 errata-xmlrpc 2025-10-27 19:34:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:19105 https://access.redhat.com/errata/RHSA-2025:19105
Comment 8 errata-xmlrpc 2025-11-12 11:25:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:21112 https://access.redhat.com/errata/RHSA-2025:21112
Comment 9 errata-xmlrpc 2025-11-12 12:22:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21118 https://access.redhat.com/errata/RHSA-2025:21118
Comment 10 errata-xmlrpc 2025-11-17 00:35:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:21397 https://access.redhat.com/errata/RHSA-2025:21397
Comment 11 errata-xmlrpc 2025-11-17 00:45:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:21398 https://access.redhat.com/errata/RHSA-2025:21398
Note You need to log in before you can comment on or make changes to this bug.