tls: always refresh the queue when reading sock
Priority MEDIUM 42CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 19 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len").
Why it matters now
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1, 6.1.147, 6.6.100 +3Red Hat: 8 advisoriesRed Hat: 19 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 6.0.6 to before 6.1 | 6.1 | Patch available | CNA |
| Linux | Linux | 6.1 and later | 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16 | Patch available | CNA |
- Linux VendorLinux Affected 6.0.6 to before 6.1 Fixed in 6.1 Patch available CNA
- Linux VendorLinux Affected 6.1 and later Fixed in 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16 Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.0.6 to before 6.1; 6.1.1 to before 6.1.147; 6.2 to before 6.6.100; 6.7 to before 6.12.40; 6.13 to before 6.15.8 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* | 6.1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | 6.1 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* | 6.1 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* | 6.1 rc4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* | 6.1 rc5 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* | 6.1 rc6 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* | 6.1 rc7 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* | 6.1 rc8 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | 6.16 rc1 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.0.6 to before 6.1; 6.1.1 to before 6.1.147; 6.2 to before 6.6.100; 6.7 to before 6.12.40; 6.13 to before 6.15.8 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* Versions 6.1 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* Versions 6.1 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* Versions 6.1 rc4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* Versions 6.1 rc5 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* Versions 6.1 rc6 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* Versions 6.1 rc7 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* Versions 6.1 rc8 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* Versions 6.16 rc1 Vulnerable ·Linux
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | 6.16 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* | 6.16 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* | 6.16 rc4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* | 6.16 rc5 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* | 6.16 rc6 | Vulnerable | Linux |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* Versions 6.16 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* Versions 6.16 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* Versions 6.16 rc4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* Versions 6.16 rc5 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* Versions 6.16 rc6 Vulnerable ·Linux
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA Linux (Linux) Fixed in 6.1
- Fix · CNA Linux (Linux) Fixed in 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16
Red Hat 8 advisories
- RHSA-2025:14811 Released 2025-08-28 · Red Hat rating Importantkpatch-patch-5_14_0-427_13_1, kpatch-patch-5_14_0-427_31_1, kpatch-patch-5_14_0-427_44_1, kpatch-patch-5_14_0-427_55_1, and kpatch-patch-5_14_0-427_68_2 security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) kpatch-patch-5_14_0-427_13_1-1-12.el9_4, kpatch-patch-5_14_0-427_31_1-1-10.el9_4, kpatch-patch-5_14_0-427_44_1-1-8.el9_4 +2
- RHSA-2025:14599 Released 2025-08-26 · Red Hat rating Importantkpatch-patch-5_14_0-284_104_1, kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_52_1, kpatch-patch-5_14_0-284_79_1, and kpatch-patch-5_14_0-284_92_1 security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) kpatch-patch-5_14_0-284_104_1-1-6.el9_2, kpatch-patch-5_14_0-284_117_1-1-3.el9_2, kpatch-patch-5_14_0-284_52_1-1-14.el9_2 +2
- RHSA-2025:14497 Released 2025-08-25 · Red Hat rating Importantkpatch-patch-5_14_0-570_17_1 security update
- Red Hat Enterprise Linux BaseOS (v. 9) kpatch-patch-5_14_0-570_17_1-1-6.el9_6
Show 5 more Red Hat advisories
- RHSA-2025:14082 Released 2025-08-19 · Red Hat rating Importantkernel security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.84.1.el9_4, libperf-5.14.0-427.84.1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.84.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.84.1.el9_4, kernel-64k-devel-5.14.0-427.84.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.84.1.el9_4, kernel-5.14.0-427.84.1.el9_4, kernel-64k-5.14.0-427.84.1.el9_4 +29
- Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.84.1.el9_4, kernel-rt-core-5.14.0-427.84.1.el9_4, kernel-rt-debug-5.14.0-427.84.1.el9_4 +9
- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.84.1.el9_4, kernel-rt-core-5.14.0-427.84.1.el9_4, kernel-rt-debug-5.14.0-427.84.1.el9_4 +11
- RHSA-2025:13962 Released 2025-08-18 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-570.35.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.35.1.el9_6, kernel-64k-devel-5.14.0-570.35.1.el9_6 +12
- Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-570.35.1.el9_6, kernel-64k-5.14.0-570.35.1.el9_6, kernel-64k-core-5.14.0-570.35.1.el9_6 +28
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-570.35.1.el9_6, libperf-5.14.0-570.35.1.el9_6
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-570.35.1.el9_6, kernel-rt-64k-5.14.0-570.35.1.el9_6, kernel-rt-64k-core-5.14.0-570.35.1.el9_6 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-570.35.1.el9_6, kernel-rt-core-5.14.0-570.35.1.el9_6, kernel-rt-debug-5.14.0-570.35.1.el9_6 +11
- RHSA-2025:14009 Released 2025-08-18 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-55.28.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.28.1.el10_0, kernel-64k-devel-6.12.0-55.28.1.el10_0 +12
- Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-55.28.1.el10_0, kernel-64k-6.12.0-55.28.1.el10_0, kernel-64k-core-6.12.0-55.28.1.el10_0 +28
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-55.28.1.el10_0, libperf-6.12.0-55.28.1.el10_0
- Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-55.28.1.el10_0, kernel-rt-64k-6.12.0-55.28.1.el10_0, kernel-rt-64k-core-6.12.0-55.28.1.el10_0 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-55.28.1.el10_0, kernel-rt-core-6.12.0-55.28.1.el10_0, kernel-rt-debug-6.12.0-55.28.1.el10_0 +11
- RHSA-2025:14005 Released 2025-08-18 · Red Hat rating Importantkernel-rt security update
- Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.131.1.rt14.416.el9_2, kernel-rt-core-5.14.0-284.131.1.rt14.416.el9_2, kernel-rt-debug-5.14.0-284.131.1.rt14.416.el9_2 +9
- Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.131.1.rt14.416.el9_2, kernel-rt-core-5.14.0-284.131.1.rt14.416.el9_2, kernel-rt-debug-5.14.0-284.131.1.rt14.416.el9_2 +11
- RHSA-2025:14003 Released 2025-08-18 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.131.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.131.1.el9_2, kernel-64k-devel-5.14.0-284.131.1.el9_2 +10
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.131.1.el9_2, kernel-5.14.0-284.131.1.el9_2, kernel-64k-5.14.0-284.131.1.el9_2 +29
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2025:14082 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:14009 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:13962 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:14003 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:14082 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2025:14009 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:13962, RHSA-2025:14497 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2025:14003, RHSA-2025:14599 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:14082, RHSA-2025:14811 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2025:14009 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2025:13962 |
| Red Hat Enterprise Linux Real Time (v. 10) | Fixed | RHSA-2025:14009 |
| Red Hat Enterprise Linux Real Time (v. 9) | Fixed | RHSA-2025:13962 |
| Red Hat Enterprise Linux Real Time E4S (v.9.2) | Fixed | RHSA-2025:14005 |
| Red Hat Enterprise Linux Real Time EUS (v.9.4) | Fixed | RHSA-2025:14082 |
| Red Hat Enterprise Linux Real Time for NFV (v. 10) | Fixed | RHSA-2025:14009 |
| Red Hat Enterprise Linux Real Time for NFV (v. 9) | Fixed | RHSA-2025:13962 |
| Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) | Fixed | RHSA-2025:14005 |
| Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) | Fixed | RHSA-2025:14082 |
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-38471
- 2026-10-03 Alias added: GHSA-8r96-vh27-xgf4
References
Patch 5
- https://git.kernel.org/stable/c/730fed2ff5e259495712518e18d9f521f61972bb
- https://git.kernel.org/stable/c/1f3a429c21e0e43e8b8c55d30701e91411a4df02
- https://git.kernel.org/stable/c/cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8
- https://git.kernel.org/stable/c/c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6
- https://git.kernel.org/stable/c/4ab26bce3969f8fd925fe6f6f551e4d1a508c68b
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2025-38471 · CVE Program
- CVE-2025-38471 · NVD
- FIRST EPSS
- GHSA-8r96-vh27-xgf4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-38471 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences