CVE-2025-39948

一、漏洞信息
 漏洞编号：[CVE-2025-39948](https://nvd.nist.gov/vuln/detail/CVE-2025-39948)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ice: fix Rx page leak on multi-buffer framesThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for eachbuffer in the current frame. This function was introduced as part ofhandling multi-buffer XDP support in the ice driver.It works by iterating over the buffers from first_desc up to 1 plus thetotal number of fragments in the frame, cached from before the XDP programwas executed.If the hardware posts a descriptor with a size of 0, the logic used inice_put_rx_mbuf() breaks. Such descriptors get skipped and don t get addedas fragments in ice_add_xdp_frag. Since the buffer isn t counted as afragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don tcall ice_put_rx_buf().Because we don t call ice_put_rx_buf(), we don t attempt to re-use thepage or free it. This leaves a stale page in the ring, as we don tincrement next_to_alloc.The ice_reuse_rx_page() assumes that the next_to_alloc has been incrementedproperly, and that it always points to a buffer with a NULL page. Sincethis function doesn t check, it will happily recycle a page over the topof the next_to_alloc buffer, losing track of the old page.Note that this leak only occurs for multi-buffer frames. Theice_put_rx_mbuf() function always handles at least one buffer, so asingle-buffer frame will always get handled correctly. It is not clearprecisely why the hardware hands us descriptors with a size of 0 sometimes,but it happens somewhat regularly with  jumbo frames  used by 9K MTU.To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() onall buffers between first_desc and next_to_clean. Borrow the logic of asimilar function in i40e used for this same purpose. Use the same logicalso in ice_get_pgcnts().Instead of iterating over just the number of fragments, use a loop whichiterates until the current index reaches to the next_to_clean element justpast the current frame. Unlike i40e, the ice_put_rx_mbuf() function doescall ice_put_rx_buf() on the last buffer of the frame indicating the end ofpacket.For non-linear (multi-buffer) frames, we need to take care when adjustingthe pagecnt_bias. An XDP program might release fragments from the tail ofthe frame, in which case that fragment page is already released. Onlyupdate the pagecnt_bias for the first descriptor and fragments stillremaining post-XDP program. Take care to only access the shared info forfragmented buffers, as this avoids a significant cache miss.The xdp_xmit value only needs to be updated if an XDP program is run, andonly once per packet. Drop the xdp_xmit pointer argument fromice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() functiondirectly. This avoids needing to pass the argument and avoids an extrabit-wise OR for each buffer in the frame.Move the increment of the ntc local variable to ensure its updated *before*all calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logicrequires the index of the element just after the current frame.Now that we use an index pointer in the ring to identify the packet, we nolonger need to track or cache the number of fragments in the rx_ring.
 漏洞公开时间：2025-10-04 16:15:47
 漏洞创建时间：2025-10-07 00:36:57
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39948
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://security-tracker.debian.org/tracker/CVE-2025-39948 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-39948 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39948-7074@gregkh/T/#u |  |
|  | https://git.kernel.org/stable/c/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b |  |
|  | https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39948-7074@gregkh/T |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39948 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2401415 |  |
|  | https://git.kernel.org/stable/c/80555adb5c892f0e21d243ae96ed997ee520aea9 |  |
|  | https://git.kernel.org/stable/c/fcb5718ebfe7fd64144e3399280440cce361a3ae |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/80555adb5c892f0e21d243ae96ed997ee520aea9 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/fcb5718ebfe7fd64144e3399280440cce361a3ae |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b |  | ljqc |
|  |  | https://git.kernel.org/stable/c/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/80555adb5c892f0e21d243ae96ed997ee520aea9 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/fcb5718ebfe7fd64144e3399280440cce361a3ae |  | cvelistv5 |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                         
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

src-openEuler/kernel
Closed

Content Risk Flag

Comments (3)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-39948

Comments (3)

Search

src-openEuler/kernel
Closed