CVE-2025-38018: net/tls: fix kernel panic when alloc_page failed
In the Linux kernel, the following vulnerability has been resolved:
net/tls: fix kernel panic when allocpage failed
We cannot set fraglist to NULL pointer when allocpage failed. It will be used in tlsstrpcheckqueueok when the next time tlsstrpreadsock is called.
This is because we don't reset fulllen in tlsstrpflushanchorcopy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset fulllen.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tlsstrpcheckrcv+0x128/0x27c tlsstrpdataready+0x34/0x44 tlsdataready+0x3c/0x1f0 tcpdataready+0x9c/0xe4 tcpdataqueue+0xf6c/0x12d0 tcprcvestablished+0x52c/0x798
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38018?
The severity of CVE-2025-38018 has been classified as medium, given its potential to cause kernel panics.
How do I fix CVE-2025-38018?
To fix CVE-2025-38018, update the Linux kernel to a version that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-38018?
CVE-2025-38018 affects Linux kernel versions between 6.0 and 6.1.140, as well as several versions from 6.2 to 6.15-rc6.
What happens if I ignore CVE-2025-38018?
Ignoring CVE-2025-38018 could lead to kernel panics and potential denial of service on affected systems.
Is CVE-2025-38018 specific to any Linux distribution?
CVE-2025-38018 affects the Linux kernel across various distributions, including Debian Linux.