CVE-2025-38616
Description
A flaw was found in the Linux kernel's in-kernel TLS (kTLS) receive path. This vulnerability, a race condition, allows data to be consumed from the TCP socket before the kTLS component fully takes control. A local attacker with privileged access to kTLS socket setup could exploit this timing issue, causing the system's internal data processing to reference invalid memory. This could lead to a kernel crash, resulting in a Denial of Service (DoS) for the affected system.
Statement
A race in the in-kernel TLS (kTLS) receive path allowed data to be consumed from the TCP socket before the TLS ULP took ownership, leaving internal parsing state pointing to freed buffers and potentially crashing the kernel. The fix replaces a WARN/early-exit with proper error handling: it resets the parsing state and forces a retry when the queue has changed under TLS. Practical exploitation requires local, typically privileged control over kTLS socket setup and precise timing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.1 | 7.1 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | Low | Low |
| Privileges Required | High | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
