CVE-2025-39758 (GCVE-0-2025-39758)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2025-09-29 05:58
VLAI?
Title
RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* Calculate the number of bytes we need to push, for this page * specifically */ size_t bytes = min_t(size_t, PAGE_SIZE - offset, size); /* If we can't splice it, then copy it in, as normal */ if (!sendpage_ok(page[i])) msg.msg_flags &= ~MSG_SPLICE_PAGES; /* Set the bvec pointing to the page, with len $bytes */ bvec_set_page(&bvec, page[i], bytes, offset); /* Set the iter to $size, aka the size of the whole sendpages (!!!) */ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); try_page_again: lock_sock(sk); /* Sendmsg with $size size (!!!) */ rv = tcp_sendmsg_locked(sk, &msg, size); This means we've been sending oversized iov_iters and tcp_sendmsg calls for a while. This has a been a benign bug because sendpage_ok() always returned true. With the recent slab allocator changes being slowly introduced into next (that disallow sendpage on large kmalloc allocations), we have recently hit out-of-bounds crashes, due to slight differences in iov_iter behavior between the MSG_SPLICE_PAGES and "regular" copy paths: (MSG_SPLICE_PAGES) skb_splice_from_iter iov_iter_extract_pages iov_iter_extract_bvec_pages uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere skb_splice_from_iter gets a "short" read (!MSG_SPLICE_PAGES) skb_copy_to_page_nocache copy=iov_iter_count [...] copy_from_iter /* this doesn't help */ if (unlikely(iter->count < len)) len = iter->count; iterate_bvec ... and we run off the bvecs Fix this by properly setting the iov_iter's byte count, plus sending the correct byte count to tcp_sendmsg_locked.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 5661fdd218c2799001b88c17acd19f4395e4488e (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 673cf582fd788af12cdacfb62a6a593083542481 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < edf82bc8150570167a33a7d54627d66614cbf841 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < c18646248fed07683d4cee8a8af933fc4fe83c0d (git)
Create a notification for this product.
    Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5661fdd218c2799001b88c17acd19f4395e4488e",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "673cf582fd788af12cdacfb62a6a593083542481",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "edf82bc8150570167a33a7d54627d66614cbf841",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "c18646248fed07683d4cee8a8af933fc4fe83c0d",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages\n\nEver since commit c2ff29e99a76 (\"siw: Inline do_tcp_sendpages()\"),\nwe have been doing this:\n\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\n                             size_t size)\n[...]\n        /* Calculate the number of bytes we need to push, for this page\n         * specifically */\n        size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\n        /* If we can\u0027t splice it, then copy it in, as normal */\n        if (!sendpage_ok(page[i]))\n                msg.msg_flags \u0026= ~MSG_SPLICE_PAGES;\n        /* Set the bvec pointing to the page, with len $bytes */\n        bvec_set_page(\u0026bvec, page[i], bytes, offset);\n        /* Set the iter to $size, aka the size of the whole sendpages (!!!) */\n        iov_iter_bvec(\u0026msg.msg_iter, ITER_SOURCE, \u0026bvec, 1, size);\ntry_page_again:\n        lock_sock(sk);\n        /* Sendmsg with $size size (!!!) */\n        rv = tcp_sendmsg_locked(sk, \u0026msg, size);\n\nThis means we\u0027ve been sending oversized iov_iters and tcp_sendmsg calls\nfor a while. This has a been a benign bug because sendpage_ok() always\nreturned true. With the recent slab allocator changes being slowly\nintroduced into next (that disallow sendpage on large kmalloc\nallocations), we have recently hit out-of-bounds crashes, due to slight\ndifferences in iov_iter behavior between the MSG_SPLICE_PAGES and\n\"regular\" copy paths:\n\n(MSG_SPLICE_PAGES)\nskb_splice_from_iter\n  iov_iter_extract_pages\n    iov_iter_extract_bvec_pages\n      uses i-\u003enr_segs to correctly stop in its tracks before OoB\u0027ing everywhere\n  skb_splice_from_iter gets a \"short\" read\n\n(!MSG_SPLICE_PAGES)\nskb_copy_to_page_nocache copy=iov_iter_count\n [...]\n   copy_from_iter\n        /* this doesn\u0027t help */\n        if (unlikely(iter-\u003ecount \u003c len))\n                len = iter-\u003ecount;\n          iterate_bvec\n            ... and we run off the bvecs\n\nFix this by properly setting the iov_iter\u0027s byte count, plus sending the\ncorrect byte count to tcp_sendmsg_locked."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T05:58:48.839Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5661fdd218c2799001b88c17acd19f4395e4488e"
        },
        {
          "url": "https://git.kernel.org/stable/c/673cf582fd788af12cdacfb62a6a593083542481"
        },
        {
          "url": "https://git.kernel.org/stable/c/42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf82bc8150570167a33a7d54627d66614cbf841"
        },
        {
          "url": "https://git.kernel.org/stable/c/c18646248fed07683d4cee8a8af933fc4fe83c0d"
        }
      ],
      "title": "RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39758",
    "datePublished": "2025-09-11T16:52:27.598Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2025-09-29T05:58:48.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.