High 8.4Published Sep 5, 2025

CVE-2025-39718vsock/virtio: Validate length in packet header before skb_put()

Updated under an hour ago (Oct 26, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from baddcc2c71572968cdaeee1c4ab3dc0ad90fa765 before 969b06bd8b7560efb100a34227619e7d318fbe05; from 71dc9ec9ac7d3eee785cdc986c3daeb821381e20 before ee438c492b2e0705d819ac0e25d04fae758d8f8f; from 71dc9ec9ac7d3eee785cdc986c3daeb821381e20 before faf332a10372390ce65d0b803888f4b25a388335; from 71dc9ec9ac7d3eee785cdc986c3daeb821381e20 before 676f03760ca1d69c2470cef36c44dc152494b47c; 71dc9ec9ac7d3eee785cdc986c3daeb821381e20 builds before 0dab92484474587b82e8e0455839eaf5ac7bf894; from 6.1.63 before 6.1.149	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.1.63 before 6.1.149; from 6.3 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/969b06bd8b7560efb100a34227619e7d318fbe05	patch
https://git.kernel.org/stable/c/ee438c492b2e0705d819ac0e25d04fae758d8f8f	patch
https://git.kernel.org/stable/c/faf332a10372390ce65d0b803888f4b25a388335	patch
https://git.kernel.org/stable/c/676f03760ca1d69c2470cef36c44dc152494b47c	patch
https://git.kernel.org/stable/c/0dab92484474587b82e8e0455839eaf5ac7bf894	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.