CVE-2025-21926 net: gso: fix ownership in __udp_gso_segment
A missing socket reference cleanup in Linux kernel UDP segmentation causes a kernel bug and system crash when specific OpenVSwitch actions are used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21926?
CVE-2025-21926 is a high-severity vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: gso: fix ownership in __udp_gso_segment
In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan) RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action:
1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path. 4. If it later hits skb_orphan, we hit the bug.
Fix this by also removing the reference to the socket in __udp_gso_segment.
Which versions are affected by CVE-2025-21926?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21926?
Apply the vendor's patch.
Is CVE-2025-21926 being exploited?
There is no known exploitation of CVE-2025-21926 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21926, DEBIAN-CVE-2025-21926, GHSA-jwp5-c35f-qv38, ROOT-OS-UBUNTU-2404-CVE-2025-21926, UBUNTU-CVE-2025-21926.