CVE-2025-38566: sunrpc: fix handling of server side tls alerts

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-19 · updated 2026-10-15
Weakness: CWE-754

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

Affected products

Linux kernel: from 6.4 before 6.6.102; from 6.7 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1; 6.17-rc1 — fixed in 6.12.42, 6.15.10, 6.16.1, 6.6.102

How to fix

Upgrade to a fixed version: Linux kernel 6.12.42, 6.15.10, 6.16.1, 6.6.102. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-38566 or the next vulnerability affects your stack