CVE-2025-22058 is a vulnerability in the Linux kernel's UDP networking stack related to improper memory accounting caused by an integer overflow. The issue arises when an application sets the socket receive buffer size (SO_RCVBUF) to INT_MAX (2,147,483,647), triggering an integer overflow in the udp_rmem_release() function during socket closure. Specifically, when a UDP socket is closed, the kernel purges its receive queue and sums the true size of the socket buffers (skb->truesize) in an unsigned integer variable. This total is then passed to udp_rmem_release(), which expects a signed integer argument. Due to the overflow, the total size wraps around to a large negative value, causing incorrect adjustments to the socket's forward allocation memory counter (sk_forward_alloc). This results in the UDP memory usage reported in /proc/net/sockstat spiking to extremely high values (e.g., 524,288 pages) and never decreasing, effectively leaking memory. The leak causes the UDP memory accounting to double unexpectedly, leading to memory exhaustion. When the socket's receive memory allocation exceeds the configured minimum (net.ipv4.udp_rmem_min), further memory allocations fail, causing intermittent packet drops and degraded network performance. The vulnerability is reproducible with a simple Python script that sets SO_RCVBUFFORCE to INT_MAX and sends UDP packets continuously. The root cause is the use of signed integers for memory accounting calculations, which should be unsigned to prevent overflow. The fix involves changing the calculation to use unsigned integers and adjusting the memory accounting logic to avoid multiple calls that exacerbate the overflow. This vulnerability affects Linux kernel versions identified by the commit hash f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb and likely other versions around that timeframe. No known exploits are reported in the wild as of now.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions, especially those handling high volumes of UDP traffic or using applications that manipulate socket buffer sizes aggressively. The memory leak can lead to resource exhaustion on critical servers, network appliances, or infrastructure devices, causing packet loss and degraded network reliability. This can impact services relying on UDP protocols such as DNS, VoIP, streaming, and real-time communications, potentially disrupting business operations. In environments with high network throughput or where UDP sockets are frequently opened and closed, the risk of triggering this vulnerability increases. Additionally, the memory leak could be exploited by a local attacker or a compromised application to cause denial of service (DoS) conditions, affecting availability. While no remote code execution or privilege escalation is indicated, the denial of service impact on network-dependent services could have cascading effects on business continuity, especially in sectors like finance, telecommunications, and critical infrastructure prevalent in Europe.

European organizations should prioritize patching affected Linux kernel versions to incorporate the fix that changes memory accounting from signed to unsigned integers and corrects the udp_rmem_release() logic. Until patches are applied, administrators should monitor UDP memory usage via /proc/net/sockstat for abnormal spikes and investigate applications setting unusually high SO_RCVBUF values, restricting such configurations where possible. Network segmentation and limiting UDP traffic from untrusted sources can reduce exposure. Employing kernel hardening and resource limits (e.g., cgroups) to constrain socket buffer sizes may mitigate impact. Additionally, updating system monitoring and alerting to detect unusual UDP memory consumption patterns can enable early detection of exploitation attempts or misconfigurations. Organizations should also review and test critical UDP-based applications for compatibility with patched kernels to avoid service disruptions during updates.