CVE-2025-38545

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info

While transitioning from netdev_alloc_ip_align() to build_skb(), memory for the "skb_shared_info" member of an "skb" was not allocated. Fix this by allocating "PAGE_SIZE" as the skb length, accounting for the packet length, headroom and tailroom, thereby including the required memory space for skb_shared_info.

A flaw was found in the Linux kernel's Texas Instruments AM65 CPSW network driver (am65-cpsw-nuss) that affects Red Hat Enterprise Linux 10 and has been assessed as having Low impact. When this driver was converted from netdev_alloc_ip_align() to build_skb(), the memory allocated for the socket buffer (skb) did not account for the skb_shared_info structure, leaving the buffer smaller than the kernel's skb layout requires. While handling packets on the AM65 CPSW ethernet interface, the kernel can access memory beyond the end of the allocated buffer, resulting in memory corruption and a potential kernel crash or panic. The consequence is limited to availability, with no impact on confidentiality or integrity. Red Hat scored this flaw CVSS 3.1 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), which differs meaningfully from the CVEORG score of 7.5 that assumes a network vector requiring no privileges; Red Hat's scoring reflects a local attack vector with high privileges required and availability-only impact on systems using this specific TI ethernet hardware. The vulnerable code was introduced upstream in Linux 6.10 and is not present in Red Hat Enterprise Linux 6, 7, 8, or 9, nor in Red Hat In-Vehicle OS, so those products are not affected. For Red Hat Enterprise Linux 10, the fix has been deferred to a future update given the Low impact rating; the residual risk on deferred systems is a potential kernel crash (denial of service) during packet processing on the affected AM65 CPSW interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.