CVE-2025-23138: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-23138 is a vulnerability in the Linux kernel's watch_queue mechanism, discovered and disclosed on April 16, 2025. The vulnerability affects the pipe buffer accounting system in the Linux kernel, specifically in the watch_queue_set_size() function (NVD, Red Hat).

The vulnerability occurs when watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This mismatch in accounting can lead to an underflow condition when the pipe is freed. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When the pipe is ultimately freed, the system decrements user->pipe_bufs by a value different from what was initially charged, potentially leading to an underflow condition. This can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM errors (NVD).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No user interaction is needed for exploitation (Red Hat).

The fix involves explicitly accounting for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers(). Red Hat Enterprise Linux 9 has deferred the fix for both kernel and kernel-rt packages (Red Hat).