### [CVE-2025-38463](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38463)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=270a1c3de47e49dd2fc18f48e46b101e48050e78%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=6.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:tcp: Correct signedness in skb remaining space calculationSyzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.When we send data, if an skb exists at the tail of the write queue, thekernel will attempt to append the new data to that skb. However, the codethat checks for available space in the skb is flawed:'''copy = size_goal - skb->len'''The types of the variables involved are:'''copy: ssize_t (s64 on 64-bit systems)size_goal: intskb->len: unsigned int'''Due to C's type promotion rules, the signed size_goal is converted to anunsigned int to match skb->len before the subtraction. The result is anunsigned int.When this unsigned int result is then assigned to the s64 copy variable,it is zero-extended, preserving its non-negative value. Consequently, copyis always >= 0.Assume we are sending 2GB of data and size_goal has been adjusted to avalue smaller than skb->len. The subtraction will result in copy holding avery large positive integer. In the subsequent logic, this large value isused to update sk->sk_forward_alloc, which can easily cause it to overflow.The syzkaller reproducer uses TCP_REPAIR to reliably create thiscondition. However, this can also occur in real-world scenarios. Thetcp_bound_to_half_wnd() function can also reduce size_goal to a smallvalue. This would cause the subsequent tcp_wmem_schedule() to setsk->sk_forward_alloc to a value close to INT_MAX. Further memoryallocation requests would then cause sk_forward_alloc to wrap around andbecome negative.[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/w4zu/Debian_security