CVE-2025-39913: Linux Kernel TCP BPF DOS Vulnerability

CVE-2025-39913 Overview

CVE-2025-39913 is a Linux kernel vulnerability in the tcp_bpf subsystem. The flaw occurs when tcp_bpf_send_verdict() fails to allocate psock->cork and does not revert the sk->sk_forward_alloc accounting change previously made by sk_msg_alloc(). This inconsistent state triggers a warning in inet_sock_destruct() and corrupts socket memory accounting. A local attacker with the ability to load sk_msg BPF programs and attach them to a SOCKMAP can trigger the condition under memory pressure. The issue affects multiple stable Linux kernel branches and Debian Linux distributions.

Critical Impact
Local users with BPF privileges can corrupt kernel socket memory accounting, leading to potential denial of service and integrity issues in the network stack.

Affected Products

Linux kernel (multiple stable branches, including 6.17-rc1 through 6.17-rc5)
Debian Linux 11.0
Siemens industrial products referenced in advisory SSA-253495

Discovery Timeline

2025-10-01 - CVE-2025-39913 published to NVD
2025-10-08 - Debian LTS security announcement issued
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39913

Vulnerability Analysis

The vulnerability resides in the TCP BPF (Berkeley Packet Filter) integration layer that handles socket message verdicts for programs attached to a SOCKMAP. When a sk_msg BPF program invokes bpf_msg_cork_bytes() to request that data be corked until a byte threshold is reached, the kernel calls tcp_bpf_send_verdict() to buffer the data. This function first invokes sk_msg_alloc(), which increments sk->sk_forward_alloc to reserve memory quota. It then allocates a psock->cork structure to hold the pending data.

If the cork allocation fails, the original code returned an error without releasing the forward allocation charge. The resulting mismatch between reserved and actually used memory triggers a WARN at net/ipv4/af_inet.c:156 inside inet_sock_destruct() when the socket is later destroyed. The fix calls sk_msg_free() on the failure path and resets *copied to zero so the caller receives a proper error from sendmsg().

Root Cause

The root cause is a missing cleanup path in error handling [CWE-noinfo]. The function tcp_bpf_send_verdict() did not unwind the sk->sk_forward_alloc change performed by sk_msg_alloc() when the subsequent psock->cork allocation failed. This produced an accounting imbalance that persisted until socket destruction, where kernel invariants are verified.

Attack Vector

Exploitation requires local access with permission to load BPF programs (typically CAP_BPF or CAP_SYS_ADMIN). An attacker loads a sk_msg program that calls bpf_msg_cork_bytes() with a cork threshold, attaches it to a SOCKMAP, adds a target socket, and then sends data smaller than the cork threshold under memory pressure or allocation failure conditions. The syzbot reproducer used fault injection to force the allocation to fail deterministically.

Because realCodeExamples are not available, refer to the upstream commits listed in the Kernel Git Commit 05366527 and related patch series for the exact code changes.

Detection Methods for CVE-2025-39913

Indicators of Compromise

Kernel WARNING messages originating from inet_sock_destruct+0x623/0x730 in net/ipv4/af_inet.c:156
Repeated kernel warnings tied to sockets that had sk_msg BPF programs attached via SOCKMAP
Unexpected memory accounting anomalies in /proc/net/sockstat following BPF program activity

Detection Strategies

Audit BPF program loads on production systems and correlate bpf() syscalls with sk_msg program types and SOCKMAP attachments
Monitor kernel ring buffer (dmesg) and journalctl -k for WARN splats referencing inet_sock_destruct
Use kernel version inventory tools to identify hosts running unpatched stable branches

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on inet_sock_destruct warnings
Track processes invoking bpf(BPF_PROG_LOAD) with program type BPF_PROG_TYPE_SK_MSG
Baseline memory allocation failure rates to catch conditions that could trigger the flaw

How to Mitigate CVE-2025-39913

Immediate Actions Required

Apply the stable kernel updates that include the sk_msg_free() cleanup fix on all affected hosts
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts to limit who can load sk_msg programs
For Debian systems, install the kernel update referenced in the Debian LTS Announcement 2025-10-08
Siemens operators should review the Siemens Security Advisory SSA-253495 for product-specific guidance

Patch Information

The fix is committed across multiple stable branches. Key patches include Kernel Git Commit 05366527, Kernel Git Commit 08f58d10, Kernel Git Commit 53992018, Kernel Git Commit 66bcb04a, Kernel Git Commit 7429b8b9, Kernel Git Commit 9c2a6456, Kernel Git Commit a3967baa, and Kernel Git Commit de89e583.

Workarounds

Disable or unload sk_msg BPF programs on hosts that cannot immediately be patched
Remove CAP_BPF from non-essential workloads and containers using Linux capability bounding sets
Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loading

bash

# Configuration example
# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify kernel version after patching
uname -r