{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38166",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:23.991Z",
        "datePublished": "2025-07-03T08:36:06.372Z",
        "dateUpdated": "2026-08-05T11:59:59.787Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:59:59.787Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix ktls panic with sockmap\n\n[ 2172.936997] ------------[ cut here ]------------\n[ 2172.936999] kernel BUG at lib/iov_iter.c:629!\n......\n[ 2172.944996] PKRU: 55555554\n[ 2172.945155] Call Trace:\n[ 2172.945299]  <TASK>\n[ 2172.945428]  ? die+0x36/0x90\n[ 2172.945601]  ? do_trap+0xdd/0x100\n[ 2172.945795]  ? iov_iter_revert+0x178/0x180\n[ 2172.946031]  ? iov_iter_revert+0x178/0x180\n[ 2172.946267]  ? do_error_trap+0x7d/0x110\n[ 2172.946499]  ? iov_iter_revert+0x178/0x180\n[ 2172.946736]  ? exc_invalid_op+0x50/0x70\n[ 2172.946961]  ? iov_iter_revert+0x178/0x180\n[ 2172.947197]  ? asm_exc_invalid_op+0x1a/0x20\n[ 2172.947446]  ? iov_iter_revert+0x178/0x180\n[ 2172.947683]  ? iov_iter_revert+0x5c/0x180\n[ 2172.947913]  tls_sw_sendmsg_locked.isra.0+0x794/0x840\n[ 2172.948206]  tls_sw_sendmsg+0x52/0x80\n[ 2172.948420]  ? inet_sendmsg+0x1f/0x70\n[ 2172.948634]  __sys_sendto+0x1cd/0x200\n[ 2172.948848]  ? find_held_lock+0x2b/0x80\n[ 2172.949072]  ? syscall_trace_enter+0x140/0x270\n[ 2172.949330]  ? __lock_release.isra.0+0x5e/0x170\n[ 2172.949595]  ? find_held_lock+0x2b/0x80\n[ 2172.949817]  ? syscall_trace_enter+0x140/0x270\n[ 2172.950211]  ? lockdep_hardirqs_on_prepare+0xda/0x190\n[ 2172.950632]  ? ktime_get_coarse_real_ts64+0xc2/0xd0\n[ 2172.951036]  __x64_sys_sendto+0x24/0x30\n[ 2172.951382]  do_syscall_64+0x90/0x170\n......\n\nAfter calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase,\ne.g., when the BPF program executes bpf_msg_push_data().\n\nIf the BPF program sets cork_bytes and sg.size is smaller than cork_bytes,\nit will return -ENOSPC and attempt to roll back to the non-zero copy\nlogic. However, during rollback, msg->msg_iter is reset, but since\nmsg_pl->sg.size has been increased, subsequent executions will exceed the\nactual size of msg_iter.\n'''\niov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size);\n'''\n\nThe changes in this commit are based on the following considerations:\n\n1. When cork_bytes is set, rolling back to non-zero copy logic is\npointless and can directly go to zero-copy logic.\n\n2. We can not calculate the correct number of bytes to revert msg_iter.\n\nAssume the original data is \"abcdefgh\" (8 bytes), and after 3 pushes\nby the BPF program, it becomes 11-byte data: \"abc?de?fgh?\".\nThen, we set cork_bytes to 6, which means the first 6 bytes have been\nprocessed, and the remaining 5 bytes \"?fgh?\" will be cached until the\nlength meets the cork_bytes requirement.\n\nHowever, some data in \"?fgh?\" is not within 'sg->msg_iter'\n(but in msg_pl instead), especially the data \"?\" we pushed.\n\nSo it doesn't seem as simple as just reverting through an offset of\nmsg_iter.\n\n3. For non-TLS sockets in tcp_bpf_sendmsg, when a \"cork\" situation occurs,\nthe user-space send() doesn't return an error, and the returned length is\nthe same as the input length parameter, even if some data is cached.\n\nAdditionally, I saw that the current non-zero-copy logic for handling\ncorking is written as:\n'''\nline 1177\nelse if (ret != -EAGAIN) {\n\tif (ret == -ENOSPC)\n\t\tret = 0;\n\tgoto send_end;\n'''\n\nSo it's ok to just return 'copied' without error when a \"cork\" situation\noccurs."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The trigger is a local `sendmsg()`/`sendto()` syscall on a kTLS socket enrolled in a sockmap, and the data driving the bug is the calling process's own send buffer plus the sk_msg BPF verdict — not data received from a remote peer. This is the kTLS transmit path combined with BPF/sockmap, both of which are locally reachable only.\nAC:L - Exploitation is fully deterministic — no race, no memory-layout grooming, no timing window; the attacker simply issues a `send()` whose length falls below the program's `cork_bytes` threshold and the `BUG()` fires every time. The attacker additionally chooses ITER_UBUF vs ITER_IOVEC by controlling `nr_segs`, selecting between the guaranteed panic and the out-of-bounds iterator walk.\nPR:L - Enabling kTLS TX requires no capability whatsoever (net/tls contains no `capable()` checks), and in the standard sockmap deployment the `sk_msg` program is installed by the platform/service mesh with sockets auto-enrolled on connect, so an ordinary unprivileged local user needs only a socket and a `send()` call. Where the attacker supplies the BPF program, `bpf_token_capable()` also grants `CAP_BPF`/`CAP_NET_ADMIN` inside a user namespace via a delegated BPF token.\nUI:N - The attacker performs every step themselves — create socket, enable kTLS, call send(). No action by any other user or administrator is needed at exploitation time.\nS:U - The corruption and the crash are confined to the kernel's own memory and the attacking task's socket state; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - With ≥2 iovecs, `iov_iter_revert()` walks backwards off the front of `iovstack[]` in an unbounded loop, reading kernel-stack qwords as `iov_len` and leaving `i->__iov` pointing at out-of-bounds kernel memory adjacent to the attacker-seeded `sockaddr_storage`; `i->count` is simultaneously inflated past the end of the user buffer, and the corrupted iterator is then used for further copies. This unbounded OOB kernel read plus live-iterator corruption is a disclosure primitive.\nI:H - The faulty revert writes an out-of-bounds pointer, inflated `nr_segs`, and an `iov_offset` derived from out-of-bounds kernel memory into a live kernel iterator whose neighbouring stack contents the attacker controls via `msg_name`, and the `sg.size`/`sk_mem_charge` accounting diverges from reality. Memory-safety corruption of this nature is scored High.\nA:H - The common single-buffer case hits a guaranteed `BUG()` at lib/iov_iter.c:629 while holding both `tls_ctx->tx_lock` and the socket lock, so the killed task self-deadlocks in `tls_sk_proto_close()` during exit — an unkillable D-state task with a permanently wedged socket and leaked memory. On systems with `panic_on_oops` it is an immediate full system panic, and it is trivially repeatable."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/tls/tls_sw.c"
                    ],
                    "versions": [
                        {
                            "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                            "lessThan": "328cac3f9f8ae394748485e769a527518a9137c8",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                            "lessThan": "2e36a81d388ec9c3f78b6223f7eda2088cd40adb",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                            "lessThan": "57fbbe29e86042bbaa31c1a30d2afa16c427e3f7",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                            "lessThan": "603943f022a7fe5cc83ca7005faf34798fb7853f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
                            "lessThan": "54a3ecaeeeae8176da8badbd7d72af1017032c39",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/tls/tls_sw.c"
                    ],
                    "versions": [
                        {
                            "version": "4.20",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "4.20",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.142",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.94",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.34",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15.3",
                            "lessThanOrEqual": "6.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.20",
                                    "versionEndExcluding": "6.1.142"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.20",
                                    "versionEndExcluding": "6.6.94"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.20",
                                    "versionEndExcluding": "6.12.34"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.20",
                                    "versionEndExcluding": "6.15.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.20",
                                    "versionEndExcluding": "6.16"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/328cac3f9f8ae394748485e769a527518a9137c8"
                },
                {
                    "url": "https://git.kernel.org/stable/c/2e36a81d388ec9c3f78b6223f7eda2088cd40adb"
                },
                {
                    "url": "https://git.kernel.org/stable/c/57fbbe29e86042bbaa31c1a30d2afa16c427e3f7"
                },
                {
                    "url": "https://git.kernel.org/stable/c/603943f022a7fe5cc83ca7005faf34798fb7853f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/54a3ecaeeeae8176da8badbd7d72af1017032c39"
                }
            ],
            "title": "bpf: fix ktls panic with sockmap",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
                    }
                ],
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2025-11-03T17:34:55.864Z"
                }
            }
        ]
    }
}