Improper error handling in Linux kernel ipv4

1) Improper error handling

EUVDB-ID: #VU106815

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21926

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the __udp_gso_segment() function in net/ipv4/udp_offload.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/01a83237644d6822bc7df2c5564fc81b0df84358
https://git.kernel.org/stable/c/084819b0d8b1bd433b90142371eb9450d657f8ca
https://git.kernel.org/stable/c/455217ac9db0cf9349b3933664355e907bb1a569
https://git.kernel.org/stable/c/9f28205ddb76e86cac418332e952241d85fed0dc
https://git.kernel.org/stable/c/a2d1cca955ed34873e524cc2e6e885450d262f05
https://git.kernel.org/stable/c/c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b
https://git.kernel.org/stable/c/e8db70537878e1bb3fd83e5abcc6feefc0587828
https://git.kernel.org/stable/c/ee01b2f2d7d0010787c2343463965bbc283a497f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.