{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38566", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.025Z", "datePublished": "2025-08-19T17:02:42.506Z", "dateUpdated": "2026-08-05T12:02:56.367Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:56.367Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix handling of server side tls alerts\n\nScott Mayhew discovered a security exploit in NFS over TLS in\ntls_alert_recv() due to its assumption it can read data from\nthe msg iterator's kvec..\n\nkTLS implementation splits TLS non-data record payload between\nthe control message buffer (which includes the type such as TLS\naler or TLS cipher change) and the rest of the payload (say TLS\nalert's level/description) which goes into the msg payload buffer.\n\nThis patch proposes to rework how control messages are setup and\nused by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a\nkvec backed msg buffer and read in the control message such as a\nTLS alert. Msg iterator can advance the kvec pointer as a part of\nthe copy process thus we need to revert the iterator before calling\ninto the tls_alert_recv." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is nfsd's server-side RPC-over-TLS receive path (net/sunrpc/svcsock.c), driven entirely by TLS records arriving on the TCP/2049 listener; a remote peer triggers it by sending a TLS alert record.\nAC:L - The attacker deterministically controls every precondition — complete the TLS handshake, send exactly 2 bytes of an RPC fragment marker to set sk_tcplen=2, then send any TLS alert, which exactly consumes the 2-byte kvec and forces the iterator past the end of the stack array; it can be repeated on unlimited connections.\nPR:N - svcauth_tls_accept() processes the AUTH_TLS STARTTLS probe on the NULL procedure with no credentials, and svc_tcp_handshake_done() enables kTLS even when the peer presents no certificate (TLS_NO_PEERID); export/mtls policy is only enforced far later, so the bug is reachable entirely pre-authentication.\nUI:N - The nfsd service threads process incoming TLS records autonomously; no local user or administrator action is needed once the server is listening.\nS:U - The out-of-bounds read and pointer dereference occur within the kernel's own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - tls_alert_recv() reads kernel memory through an out-of-bounds kvec element (stack contents reinterpreted as a pointer) and, in the bvec path, through a struct page * reinterpreted as a data buffer — an unbounded-address kernel read whose result is reflected back to the attacker as an observable connection-teardown oracle (-ENOTCONN vs -EAGAIN).\nI:H - This is a genuine type confusion (struct bio_vec / stale stack memory consumed as struct kvec) plus an out-of-bounds array access, and attacker-supplied alert bytes are written into kernel RPC state (svsk->sk_marker, rq_pages) outside the protocol's intended flow, with the confused read steering kernel control flow.\nA:H - Dereferencing the pointer-sized value read past the end of the stack-allocated kvec (frequently NULL or a non-canonical/unmapped address) faults inside an nfsd service thread, producing a kernel oops and taking down the NFS server." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/svcsock.c" ], "versions": [ { "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "b1df394621710b312f0393e3f240fdac0764f968", "status": "affected", "versionType": "git" }, { "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "25bb3647d30a20486b5fe7cff2b0e503c16c9692", "status": "affected", "versionType": "git" }, { "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "3b549da875414989f480b66835d514be80a0bd9c", "status": "affected", "versionType": "git" }, { "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "6b33c31cc788073bfbed9297e1f4486ed73d87da", "status": "affected", "versionType": "git" }, { "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "bee47cb026e762841f3faece47b51f985e215edb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/svcsock.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.102", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.42", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.10", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.102" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.16.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f968" }, { "url": "https://git.kernel.org/stable/c/25bb3647d30a20486b5fe7cff2b0e503c16c9692" }, { "url": "https://git.kernel.org/stable/c/3b549da875414989f480b66835d514be80a0bd9c" }, { "url": "https://git.kernel.org/stable/c/6b33c31cc788073bfbed9297e1f4486ed73d87da" }, { "url": "https://git.kernel.org/stable/c/bee47cb026e762841f3faece47b51f985e215edb" } ], "title": "sunrpc: fix handling of server side tls alerts", "x_generator": { "engine": "bippy-1.2.0" } } } }