CVE-2025-39718

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Validate length in packet header before skb_put()

When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky.

Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().

A flaw in the virtio vsock receive path trusted the packet header’s len field and passed it to skb_put() without first ensuring it fit within the received buffer, enabling an out-of-bounds write if the host provides a malformed header (means attack from host to client). The patch validates the header-advertised payload length before calling virtio_vsock_skb_rx_put(). This is adjacent-vector and host-to-guest exploitable. This vulnerability can only be exploited in environments where virtio-vsock is in use (i.e., when CONFIG_VIRTIO_VSOCKETS is enabled and guest-to-host communication via vsock is active).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module vmw_vsock_virtio_transport from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.