CVE-2025-23138: fallo en Linux
watch_queue: fix pipe accounting mismatch
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.2%
probabilidad de explotación
0.2%top 90% de las CVE
explotación observada
noninguna fuente lo reporta
In the Linux kernel, the following vulnerability has been resolved:
watch_queue: fix pipe accounting mismatch
Currently, watch_queue_set_size() modifies the pipe buffers charged to
user->pipe_bufs without updating the pipe->nr_accounted on the pipe
itself, due to the if (!pipe_has_watch_queue()) test in
pipe_resize_ring(). This means that when the pipe is ultimately freed,
we decrement user->pipe_bufs by something other than what than we had
charged to it, potentially leading to an underflow. This in turn can
cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in
watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted;
it may be due to intentional overprovisioning in watch_queue_set_size()?)
Productos afectados
Linux · LinuxCVEs relacionadas — Linux
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 3.4%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 2.9%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEVCVE-2024-53150HIGHALSA: usb-audio: Fix out of bounds reads when finding clock sourcesEPSS 1.4%KEV
Referencias
https://git.kernel.org/stable/c/205028ebba838938d3b264dda1d0708fa7fe1adehttps://git.kernel.org/stable/c/2d680b988656bb556c863d8b46d9b9096842bf3dhttps://git.kernel.org/stable/c/471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284https://git.kernel.org/stable/c/56ec918e6c86c1536870e4373e91eddd0c44245fhttps://git.kernel.org/stable/c/6dafa27764183738dc5368b669b71e3d0d154f12https://git.kernel.org/stable/c/8658c75343ed00e5e154ebbe24335f51ba8db547https://git.kernel.org/stable/c/d40e3537265dea9e3c33021874437ff26dc18787https://git.kernel.org/stable/c/f13abc1e8e1a3b7455511c4e122750127f6bc9b0https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2025/05/msg00045.html