UBUNTU-CVE-2025-38616: High severity ubuntu/linux-hwe-edge vulnerability

Q: Which Ubuntu kernel package families are identified as affected?

The listed packages are ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, and ubuntu/linux-gkeop.

Q: What conditions are needed to trigger the issue?

The condition involves a TCP socket using the TLS ULP where another reader entered before the TLS ULP was installed or uses a non-standard read API, such as a zerocopy API. The supplied vector indicates local access, low privileges, high attack complexity, and an additional attack requirement.

Q: What can happen if data is consumed outside the TLS ULP's expected receive-queue handling?

TLS parsing state may become inconsistent and the TLS stream may experience undefined behavior, such as stream corruption or missed TLS alerts or attacks. The resolution replaces a freed-buffer-pointer condition with error handling that clears parsing state and tells the reader to retry; the description says a kernel crash should not occur in the remaining scenario.

Published Aug 22, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Replace the WARNON() and a buggy early exit (which leaves anchor pointing to a freed skb) with real error handling. Wipe the parsing state and tell the reader to retry. We already reload the anchor every time we (re)acquire the socket lock, so the only condition we need to avoid is an out of bounds read (not having enough bytes in the socket for previously parsed record len). If some data was read from under TLS but there's enough in the queue we'll reload and decrypt what is most likely not a valid TLS record. Leading to some undefined behavior from TLS perspective (corrupting a stream? missing an alert? missing an attack?) but no kernel crash should take place.

Affected Software

133 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1043.45~22.04.1

6.8.0-1043.45~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1044.50~22.04.1

6.8.0-1044.50~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1044.47~22.04.1

6.8.0-1044.47~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-88.89~22.04.2

6.8.0-88.89~22.04.2

ubuntu/linux-ibm-6.8<6.8.0-1041.41~22.04.1

6.8.0-1041.41~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-88.89.1~22.04.1

6.8.0-88.89.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1043.46~22.04.1

6.8.0-1043.46~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1040.41~22.04.1

6.8.0-1040.41~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-88.89~22.04.1

6.8.0-88.89~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1038.39~22.04.1

6.8.1-1038.39~22.04.1

ubuntu/linux<6.8.0-88.89

6.8.0-88.89

ubuntu/linux-aws<6.8.0-1043.45

6.8.0-1043.45

ubuntu/linux-aws-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure<6.8.0-1044.50

6.8.0-1044.50

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1029.32

6.8.0-1029.32

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1044.47

6.8.0-1044.47

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1020.21~24.04.1

6.14.0-1020.21~24.04.1

ubuntu/linux-gke<6.8.0-1040.45

6.8.0-1040.45

ubuntu/linux-gkeop<6.8.0-1027.30

6.8.0-1027.30

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1041.41

6.8.0-1041.41

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-88.89.1

6.8.0-88.89.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1043.46

6.8.0-1043.46

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1043.46.1

6.8.0-1043.46.1

ubuntu/linux-nvidia-tegra<6.8.0-1013.13

6.8.0-1013.13

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1016.16

6.14.0-1016.16

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1040.41

6.8.0-1040.41

ubuntu/linux-oracle-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-raspi<6.8.0-1043.47

6.8.0-1043.47

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-36.36.1~24.04.1

6.14.0-36.36.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1020.21

6.8.0-1020.21

ubuntu/linux-bluefield<6.8.0-1013.17

6.8.0-1013.17

ubuntu/linux-raspi-realtime<6.8.0-2034.35

6.8.0-2034.35

ubuntu/linux-realtime<6.8.1-1038.39

6.8.1-1038.39

ubuntu/linux-realtime-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-aws-fips<6.8.0-1043.45+fips1

6.8.0-1043.45+fips1

ubuntu/linux-azure-fips<6.8.0-1044.50+fips1

6.8.0-1044.50+fips1

ubuntu/linux-fips<6.8.0-88.89+fips1

6.8.0-88.89+fips1

ubuntu/linux-gcp-fips<6.8.0-1044.47+fips1

6.8.0-1044.47+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.45~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.47~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89~22.04.2
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.41~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1040.41~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1038.39~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.45
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.32
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.47
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1020.21~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1040.45
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.30
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.41
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1013.13
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1040.41
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.47
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-36.36.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.21
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1013.17
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2034.35
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1038.39
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.45+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-88.89+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.47+fips1

Event History

Aug 22, 2025

CVE Published

via OSV·02:15 PM

Data Sourced

via OSV·02:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel package families are identified as affected?

The listed packages are ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, and ubuntu/linux-gkeop.

What conditions are needed to trigger the issue?

The condition involves a TCP socket using the TLS ULP where another reader entered before the TLS ULP was installed or uses a non-standard read API, such as a zerocopy API. The supplied vector indicates local access, low privileges, high attack complexity, and an additional attack requirement.

What can happen if data is consumed outside the TLS ULP's expected receive-queue handling?

TLS parsing state may become inconsistent and the TLS stream may experience undefined behavior, such as stream corruption or missed TLS alerts or attacks. The resolution replaces a freed-buffer-pointer condition with error handling that clears parsing state and tells the reader to retry; the description says a kernel crash should not occur in the remaining scenario.

UBUNTU-CVE-2025-38616: High severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel package families are identified as affected?

What conditions are needed to trigger the issue?

What can happen if data is consumed outside the TLS ULP's expected receive-queue handling?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel package families are identified as affected?

What conditions are needed to trigger the issue?

What can happen if data is consumed outside the TLS ULP's expected receive-queue handling?