CVE-2025-39758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39758", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.125Z", "datePublished": "2025-09-11T16:52:27.598Z", "dateUpdated": "2026-08-23T12:45:23.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:45:23.784Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages\n\nEver since commit c2ff29e99a76 (\"siw: Inline do_tcp_sendpages()\"),\nwe have been doing this:\n\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\n size_t size)\n[...]\n /* Calculate the number of bytes we need to push, for this page\n * specifically */\n size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\n /* If we can't splice it, then copy it in, as normal */\n if (!sendpage_ok(page[i]))\n msg.msg_flags &= ~MSG_SPLICE_PAGES;\n /* Set the bvec pointing to the page, with len $bytes */\n bvec_set_page(&bvec, page[i], bytes, offset);\n /* Set the iter to $size, aka the size of the whole sendpages (!!!) */\n iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);\ntry_page_again:\n lock_sock(sk);\n /* Sendmsg with $size size (!!!) */\n rv = tcp_sendmsg_locked(sk, &msg, size);\n\nThis means we've been sending oversized iov_iters and tcp_sendmsg calls\nfor a while. This has a been a benign bug because sendpage_ok() always\nreturned true. With the recent slab allocator changes being slowly\nintroduced into next (that disallow sendpage on large kmalloc\nallocations), we have recently hit out-of-bounds crashes, due to slight\ndifferences in iov_iter behavior between the MSG_SPLICE_PAGES and\n\"regular\" copy paths:\n\n(MSG_SPLICE_PAGES)\nskb_splice_from_iter\n iov_iter_extract_pages\n iov_iter_extract_bvec_pages\n uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere\n skb_splice_from_iter gets a \"short\" read\n\n(!MSG_SPLICE_PAGES)\nskb_copy_to_page_nocache copy=iov_iter_count\n [...]\n copy_from_iter\n /* this doesn't help */\n if (unlikely(iter->count < len))\n len = iter->count;\n iterate_bvec\n ... and we run off the bvecs\n\nFix this by properly setting the iov_iter's byte count, plus sending the\ncorrect byte count to tcp_sendmsg_locked."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - siw is an iWARP/RDMA transport running over TCP, and the overrun parameters (`read_size`, `source_to`/page offset, and GSO/FPDU segment size) come straight from a remote peer's RDMA READ Request via `siw_init_rresp()`; the same TX path serves network-facing kernel ULPs (nfsd/RDMA, ksmbd SMB Direct, nvmet-rdma) layered on soft-iWARP, and the out-of-bounds data is copied into the TCP skb and sent back over the network.\nAC:L - The attacker deterministically creates the overrun by choosing a non-page-aligned local offset with a transfer length \u2265 PAGE_SIZE, which forces `size > bytes` on the very first iteration; `zcopy_tx` is on by default and READ.Responses are always non-signalled, so no race or unpredictable state is involved.\nPR:N - A remote iWARP peer needs only an established MPA/TCP connection to a soft-iWARP target \u2014 nvmet-rdma and NFS/RDMA targets accept connections with no transport-level authentication, and the \u22654 KB kmalloc-backed reply/READ-Response path is exercised immediately after connect.\nUI:N - The overrun happens entirely inside the kernel's RDMA transmit path while servicing a peer-initiated request; no local user has to open, mount, or click anything.\nS:U - The out-of-bounds access and its consequences are confined to the kernel's own memory and the affected RDMA connection, with no crossing of a VM, IOMMU, or other security-authority boundary.\nC:H - `iterate_bvec()` fabricates `struct page *` values from stack residue and copies memory from those arbitrary kernel addresses into the outgoing TCP stream, so kernel memory \u2014 up to ~64 KB per FPDU \u2014 is disclosed directly to the remote peer, an effectively arbitrary kernel read primitive.\nI:H - Kernel memory is substituted for legitimate RDMA payload delivered to the peer, silently corrupting data that NFS/RDMA, SMB Direct, and NVMe-oF clients commit to files and block devices, and the oversized return value underflows the `size_t bytes` counter, corrupting siw's send-length accounting and retry loop.\nA:H - Dereferencing fabricated `struct page` pointers via `kmap_local_page()` and memcpy'ing from unmapped addresses reliably oopses or panics the kernel \u2014 the crashes the fix commit reports \u2014 and the `bytes` underflow can wedge the transmit loop; the attacker can repeat this at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_tx.c"], "versions": [{"version": "a19a58ab12695abb91a4e8ecf62cc0bc5badefbe", "lessThan": "b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc", "status": "affected", "versionType": "git"}, {"version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "lessThan": "5661fdd218c2799001b88c17acd19f4395e4488e", "status": "affected", "versionType": "git"}, {"version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "lessThan": "673cf582fd788af12cdacfb62a6a593083542481", "status": "affected", "versionType": "git"}, {"version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "lessThan": "42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8", "status": "affected", "versionType": "git"}, {"version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "lessThan": "edf82bc8150570167a33a7d54627d66614cbf841", "status": "affected", "versionType": "git"}, {"version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "lessThan": "c18646248fed07683d4cee8a8af933fc4fe83c0d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_tx.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.43", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.11", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.2", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.16.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc"}, {"url": "https://git.kernel.org/stable/c/5661fdd218c2799001b88c17acd19f4395e4488e"}, {"url": "https://git.kernel.org/stable/c/673cf582fd788af12cdacfb62a6a593083542481"}, {"url": "https://git.kernel.org/stable/c/42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8"}, {"url": "https://git.kernel.org/stable/c/edf82bc8150570167a33a7d54627d66614cbf841"}, {"url": "https://git.kernel.org/stable/c/c18646248fed07683d4cee8a8af933fc4fe83c0d"}], "title": "RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc", "status": "affected", "version": "a19a58ab12695abb91a4e8ecf62cc0bc5badefbe", "versionType": "git"}, {"lessThan": "5661fdd218c2799001b88c17acd19f4395e4488e", "status": "affected", "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "versionType": "git"}, {"lessThan": "673cf582fd788af12cdacfb62a6a593083542481", "status": "affected", "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "versionType": "git"}, {"lessThan": "42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8", "status": "affected", "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "versionType": "git"}, {"lessThan": "edf82bc8150570167a33a7d54627d66614cbf841", "status": "affected", "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "versionType": "git"}, {"lessThan": "c18646248fed07683d4cee8a8af933fc4fe83c0d", "status": "affected", "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.43", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.11", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0671C86-DE03-40C0-BDE5-B2242961ACA8", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages\n\nEver since commit c2ff29e99a76 (\"siw: Inline do_tcp_sendpages()\"),\nwe have been doing this:\n\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\n size_t size)\n[...]\n /* Calculate the number of bytes we need to push, for this page\n * specifically */\n size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\n /* If we can't splice it, then copy it in, as normal */\n if (!sendpage_ok(page[i]))\n msg.msg_flags &= ~MSG_SPLICE_PAGES;\n /* Set the bvec pointing to the page, with len $bytes */\n bvec_set_page(&bvec, page[i], bytes, offset);\n /* Set the iter to $size, aka the size of the whole sendpages (!!!) */\n iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);\ntry_page_again:\n lock_sock(sk);\n /* Sendmsg with $size size (!!!) */\n rv = tcp_sendmsg_locked(sk, &msg, size);\n\nThis means we've been sending oversized iov_iters and tcp_sendmsg calls\nfor a while. This has a been a benign bug because sendpage_ok() always\nreturned true. With the recent slab allocator changes being slowly\nintroduced into next (that disallow sendpage on large kmalloc\nallocations), we have recently hit out-of-bounds crashes, due to slight\ndifferences in iov_iter behavior between the MSG_SPLICE_PAGES and\n\"regular\" copy paths:\n\n(MSG_SPLICE_PAGES)\nskb_splice_from_iter\n iov_iter_extract_pages\n iov_iter_extract_bvec_pages\n uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere\n skb_splice_from_iter gets a \"short\" read\n\n(!MSG_SPLICE_PAGES)\nskb_copy_to_page_nocache copy=iov_iter_count\n [...]\n copy_from_iter\n /* this doesn't help */\n if (unlikely(iter->count < len))\n len = iter->count;\n iterate_bvec\n ... and we run off the bvecs\n\nFix this by properly setting the iov_iter's byte count, plus sending the\ncorrect byte count to tcp_sendmsg_locked."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/siw: Corregir el recuento de bytes de sendmsg en siw_tcp_sendpages\n\nDesde el commit c2ff29e99a76 ('siw: Inline do_tcp_sendpages()'), hemos estado haciendo esto:\n\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\n size_t size)\n[...]\n /* Calcular el n\u00famero de bytes que necesitamos enviar, espec\u00edficamente para esta p\u00e1gina */\n size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\n /* Si no podemos empalmarlo, entonces copiarlo, como es normal */\n if (!sendpage_ok(page[i]))\n msg.msg_flags &= ~MSG_SPLICE_PAGES;\n /* Establecer el bvec apuntando a la p\u00e1gina, con longitud $bytes */\n bvec_set_page(&bvec, page[i], bytes, offset);\n /* Establecer el iter en $size, es decir, el tama\u00f1o de todos los sendpages (!!!) */\n iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);\ntry_page_again:\n lock_sock(sk);\n /* Sendmsg con tama\u00f1o $size (!!!) */\n rv = tcp_sendmsg_locked(sk, &msg, size);\n\nEsto significa que hemos estado enviando iov_iters y llamadas a tcp_sendmsg de tama\u00f1o excesivo durante un tiempo. Esto ha sido un error benigno porque sendpage_ok() siempre devolv\u00eda verdadero. Con los recientes cambios en el asignador de slab que se est\u00e1n introduciendo lentamente en la pr\u00f3xima versi\u00f3n (que no permiten sendpage en asignaciones grandes de kmalloc), recientemente hemos experimentado fallos por acceso fuera de l\u00edmites, debido a ligeras diferencias en el comportamiento de iov_iter entre las rutas de copia MSG_SPLICE_PAGES y las 'normales':\n\n(MSG_SPLICE_PAGES)\nskb_splice_from_iter\n iov_iter_extract_pages\n iov_iter_extract_bvec_pages\n usa i->nr_segs para detenerse correctamente antes de causar accesos fuera de l\u00edmites por todas partes\n skb_splice_from_iter obtiene una lectura 'corta'\n\n(!MSG_SPLICE_PAGES)\nskb_copy_to_page_nocache copy=iov_iter_count\n [...]\n copy_from_iter\n /* esto no ayuda */\n if (unlikely(iter->count < len))\n len = iter->count;\n iterate_bvec\n ... y nos salimos de los bvecs\n\nCorregir esto estableciendo correctamente el recuento de bytes de iov_iter, adem\u00e1s de enviar el recuento de bytes correcto a tcp_sendmsg_locked."}], "id": "CVE-2025-39758", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-11T17:15:39.663", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5661fdd218c2799001b88c17acd19f4395e4488e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/673cf582fd788af12cdacfb62a6a593083542481"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c18646248fed07683d4cee8a8af933fc4fe83c0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edf82bc8150570167a33a7d54627d66614cbf841"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages", "id": "2394647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394647"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39758", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39758\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39758\nhttps://lore.kernel.org/linux-cve-announce/2025091144-CVE-2025-39758-eaf0@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-12T08:02:47.805159+00:00", "updated": "2025-09-12T08:02:47.805204+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}