CVE-2025-39946: tls: make sure to abort the stream if headers are bogus
In the Linux kernel, the following vulnerability has been resolved:
tls: make sure to abort the stream if headers are bogus
Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data each time before we parse we can overflow the allocated skb space.
Constructing a scenario in which we're under pressure without enough data in the socket to parse the length upfront is quite hard. syzbot figured out a way to do this by serving us the header in small OOB sends, and then filling in the recvbuf with a large normal send.
Make sure that tlsrxmsgsize() aborts strp, if we reach an invalid record there's really no way to recover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch tls: make sure to abort the stream if headers are bogus - Compensating control
Abort the TLS stream/connection when TLS record headers are bogus (so the connection is aborted when the issue is discovered late, preventing parsing after potential skb overflow/invalid record retry).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39946?
CVE-2025-39946 has a medium severity rating due to its impact on secure transport protocols.
How do I fix CVE-2025-39946?
To fix CVE-2025-39946, update to the latest version of the Linux kernel that includes the necessary patches.
Which versions of the Linux kernel are affected by CVE-2025-39946?
CVE-2025-39946 affects multiple versions of the Linux kernel, particularly those prior to the patch release.
What is the impact of CVE-2025-39946 on network security?
CVE-2025-39946 can potentially allow an attacker to exploit the TLS stream, affecting data integrity and security.
Is CVE-2025-39946 being actively exploited in the wild?
As of the latest information, there are no confirmed reports of CVE-2025-39946 being actively exploited.