CVE-2025-38471: tls: always refresh the queue when reading sock
In the Linux kernel, the following vulnerability has been resolved:
tls: always refresh the queue when reading sock
After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry.
BUG: KASAN: slab-use-after-free in tlsstrpcheckrcv+0x898/0x9a0 [tls] (net/tls/tlsstrp.c:436 net/tls/tlsstrp.c:530 net/tls/tlsstrp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529
CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasanreport+0xca/0x100 tlsstrpcheckrcv+0x898/0x9a0 [tls] tlsrxrecwait+0x2c9/0x8d0 [tls] tlsswrecvmsg+0x40f/0x1aa0 [tls] inetrecvmsg+0x1c3/0x1f0
Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.fulllen").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38471?
CVE-2025-38471 has been classified with a severity rating that reflects potential risk to system integrity and performance.
How do I fix CVE-2025-38471?
To fix CVE-2025-38471, update your Linux kernel to the latest stable version where this vulnerability has been addressed.
What systems are affected by CVE-2025-38471?
CVE-2025-38471 affects the Linux kernel across various distributions and versions that rely on this component.
What are the implications of CVE-2025-38471?
The implications of CVE-2025-38471 include potential security vulnerabilities in TLS operations that could compromise data integrity.
Is CVE-2025-38471 being actively exploited?
As of now, there are no confirmed reports indicating active exploitation of CVE-2025-38471 in the wild.