CVE-2025-38566

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38566
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38566.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38566
Downstream
Related
Published
2025-08-19T17:02:42Z
Modified
2025-10-18T05:12:37.538503Z
Summary
sunrpc: fix handling of server side tls alerts
Details

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix handling of server side tls alerts

Scott Mayhew discovered a security exploit in NFS over TLS in tlsalertrecv() due to its assumption it can read data from the msg iterator's kvec..

kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer.

This patch proposes to rework how control messages are setup and used by sock_recvmsg().

If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tlsalertrecv.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5e052dda121e2870dd87181783da4a95d7d2927b
Fixed
b1df394621710b312f0393e3f240fdac0764f968
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5e052dda121e2870dd87181783da4a95d7d2927b
Fixed
25bb3647d30a20486b5fe7cff2b0e503c16c9692
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5e052dda121e2870dd87181783da4a95d7d2927b
Fixed
3b549da875414989f480b66835d514be80a0bd9c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5e052dda121e2870dd87181783da4a95d7d2927b
Fixed
6b33c31cc788073bfbed9297e1f4486ed73d87da
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5e052dda121e2870dd87181783da4a95d7d2927b
Fixed
bee47cb026e762841f3faece47b51f985e215edb

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.39
v6.12.4
v6.12.40
v6.12.41
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.15.1
v6.15.2
v6.15.3
v6.15.4
v6.15.5
v6.15.6
v6.15.7
v6.15.8
v6.15.9
v6.16
v6.16-rc1
v6.16-rc2
v6.16-rc3
v6.16-rc4
v6.16-rc5
v6.16-rc6
v6.16-rc7
v6.3
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.100
v6.6.101
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.51
v6.6.52
v6.6.53
v6.6.54
v6.6.55
v6.6.56
v6.6.57
v6.6.58
v6.6.59
v6.6.6
v6.6.60
v6.6.61
v6.6.62
v6.6.63
v6.6.64
v6.6.65
v6.6.66
v6.6.67
v6.6.68
v6.6.69
v6.6.7
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77
v6.6.78
v6.6.79
v6.6.8
v6.6.80
v6.6.81
v6.6.82
v6.6.83
v6.6.84
v6.6.85
v6.6.86
v6.6.87
v6.6.88
v6.6.89
v6.6.9
v6.6.90
v6.6.91
v6.6.92
v6.6.93
v6.6.94
v6.6.95
v6.6.96
v6.6.97
v6.6.98
v6.6.99
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "219941584422888934072911490805293927923",
            "length": 435.0
        },
        "id": "CVE-2025-38566-02fcb9a3",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bee47cb026e762841f3faece47b51f985e215edb",
        "target": {
            "function": "svc_tcp_sock_recv_cmsg",
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "219941584422888934072911490805293927923",
            "length": 435.0
        },
        "id": "CVE-2025-38566-08707c49",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b549da875414989f480b66835d514be80a0bd9c",
        "target": {
            "function": "svc_tcp_sock_recv_cmsg",
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "298887397120174138810927008612734143988",
                "327093213903980362197201265485158846968",
                "16150861841058503409709214118492006057",
                "312651228494511082424476132896235584651",
                "177230114312732745583483190238398185058",
                "241012948127763046025031175235390218234",
                "67080248240163208932328403384668160157",
                "327098223114323609577584795504757487472",
                "151241080736459392996531345615890682273",
                "159357232937517388817048643531820012551",
                "128295935475658690472700222105098426636",
                "160945523990938218849489516080713203797",
                "35145273475760222119512767640857438789",
                "207284506808978727434872674080844285794",
                "253463374326404492711282772170985607631",
                "61198327333816631210380669158864511028",
                "159631298619659622866508308888531220913",
                "81468824022221438167383590556379003626",
                "56089737361227001161641294854738430290",
                "195982448272778346972956249496706968743",
                "79096447843102550118415578326344166350",
                "172738793171001695542617011622882461243",
                "227228740766837772215644471435253589918",
                "58058800656346943546712359218355748402"
            ]
        },
        "id": "CVE-2025-38566-3bb8801f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25bb3647d30a20486b5fe7cff2b0e503c16c9692",
        "target": {
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "219941584422888934072911490805293927923",
            "length": 435.0
        },
        "id": "CVE-2025-38566-47589030",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1df394621710b312f0393e3f240fdac0764f968",
        "target": {
            "function": "svc_tcp_sock_recv_cmsg",
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "298887397120174138810927008612734143988",
                "327093213903980362197201265485158846968",
                "16150861841058503409709214118492006057",
                "312651228494511082424476132896235584651",
                "177230114312732745583483190238398185058",
                "241012948127763046025031175235390218234",
                "67080248240163208932328403384668160157",
                "327098223114323609577584795504757487472",
                "151241080736459392996531345615890682273",
                "159357232937517388817048643531820012551",
                "128295935475658690472700222105098426636",
                "160945523990938218849489516080713203797",
                "35145273475760222119512767640857438789",
                "207284506808978727434872674080844285794",
                "253463374326404492711282772170985607631",
                "61198327333816631210380669158864511028",
                "159631298619659622866508308888531220913",
                "81468824022221438167383590556379003626",
                "56089737361227001161641294854738430290",
                "195982448272778346972956249496706968743",
                "79096447843102550118415578326344166350",
                "172738793171001695542617011622882461243",
                "227228740766837772215644471435253589918",
                "58058800656346943546712359218355748402"
            ]
        },
        "id": "CVE-2025-38566-71676ce0",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bee47cb026e762841f3faece47b51f985e215edb",
        "target": {
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "298887397120174138810927008612734143988",
                "327093213903980362197201265485158846968",
                "16150861841058503409709214118492006057",
                "312651228494511082424476132896235584651",
                "177230114312732745583483190238398185058",
                "241012948127763046025031175235390218234",
                "67080248240163208932328403384668160157",
                "327098223114323609577584795504757487472",
                "151241080736459392996531345615890682273",
                "159357232937517388817048643531820012551",
                "128295935475658690472700222105098426636",
                "160945523990938218849489516080713203797",
                "35145273475760222119512767640857438789",
                "207284506808978727434872674080844285794",
                "253463374326404492711282772170985607631",
                "61198327333816631210380669158864511028",
                "159631298619659622866508308888531220913",
                "81468824022221438167383590556379003626",
                "56089737361227001161641294854738430290",
                "195982448272778346972956249496706968743",
                "79096447843102550118415578326344166350",
                "172738793171001695542617011622882461243",
                "227228740766837772215644471435253589918",
                "58058800656346943546712359218355748402"
            ]
        },
        "id": "CVE-2025-38566-73ddb975",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c31cc788073bfbed9297e1f4486ed73d87da",
        "target": {
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "298887397120174138810927008612734143988",
                "327093213903980362197201265485158846968",
                "16150861841058503409709214118492006057",
                "312651228494511082424476132896235584651",
                "177230114312732745583483190238398185058",
                "241012948127763046025031175235390218234",
                "67080248240163208932328403384668160157",
                "327098223114323609577584795504757487472",
                "151241080736459392996531345615890682273",
                "159357232937517388817048643531820012551",
                "128295935475658690472700222105098426636",
                "160945523990938218849489516080713203797",
                "35145273475760222119512767640857438789",
                "207284506808978727434872674080844285794",
                "253463374326404492711282772170985607631",
                "61198327333816631210380669158864511028",
                "159631298619659622866508308888531220913",
                "81468824022221438167383590556379003626",
                "56089737361227001161641294854738430290",
                "195982448272778346972956249496706968743",
                "79096447843102550118415578326344166350",
                "172738793171001695542617011622882461243",
                "227228740766837772215644471435253589918",
                "58058800656346943546712359218355748402"
            ]
        },
        "id": "CVE-2025-38566-89f9e1e4",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1df394621710b312f0393e3f240fdac0764f968",
        "target": {
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "219941584422888934072911490805293927923",
            "length": 435.0
        },
        "id": "CVE-2025-38566-e113ea05",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25bb3647d30a20486b5fe7cff2b0e503c16c9692",
        "target": {
            "function": "svc_tcp_sock_recv_cmsg",
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "219941584422888934072911490805293927923",
            "length": 435.0
        },
        "id": "CVE-2025-38566-e9739e57",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c31cc788073bfbed9297e1f4486ed73d87da",
        "target": {
            "function": "svc_tcp_sock_recv_cmsg",
            "file": "net/sunrpc/svcsock.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "298887397120174138810927008612734143988",
                "327093213903980362197201265485158846968",
                "16150861841058503409709214118492006057",
                "312651228494511082424476132896235584651",
                "177230114312732745583483190238398185058",
                "241012948127763046025031175235390218234",
                "67080248240163208932328403384668160157",
                "327098223114323609577584795504757487472",
                "151241080736459392996531345615890682273",
                "159357232937517388817048643531820012551",
                "128295935475658690472700222105098426636",
                "160945523990938218849489516080713203797",
                "35145273475760222119512767640857438789",
                "207284506808978727434872674080844285794",
                "253463374326404492711282772170985607631",
                "61198327333816631210380669158864511028",
                "159631298619659622866508308888531220913",
                "81468824022221438167383590556379003626",
                "56089737361227001161641294854738430290",
                "195982448272778346972956249496706968743",
                "79096447843102550118415578326344166350",
                "172738793171001695542617011622882461243",
                "227228740766837772215644471435253589918",
                "58058800656346943546712359218355748402"
            ]
        },
        "id": "CVE-2025-38566-f839b1fb",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b549da875414989f480b66835d514be80a0bd9c",
        "target": {
            "file": "net/sunrpc/svcsock.c"
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.102
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.42
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.10
Type
ECOSYSTEM
Events
Introduced
6.16.0
Fixed
6.16.1