CVE-2025-38018

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38018
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38018.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38018
Downstream
Related
Published
2025-06-18T09:28:26.443Z
Modified
2026-03-20T12:42:37.871057Z
Summary
net/tls: fix kernel panic when alloc_page failed
Details

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix kernel panic when alloc_page failed

We cannot set fraglist to NULL pointer when allocpage failed. It will be used in tlsstrpcheckqueueok when the next time tlsstrpread_sock is called.

This is because we don't reset fulllen in tlsstrpflushanchorcopy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset fulllen.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tlsstrpcheckrcv+0x128/0x27c tlsstrpdataready+0x34/0x44 tlsdataready+0x3c/0x1f0 tcpdataready+0x9c/0xe4 tcpdataqueue+0xf6c/0x12d0 tcprcvestablished+0x52c/0x798

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38018.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
84c61fe1a75b4255df1e1e7c054c9e6d048da417
Fixed
8f7f96549bc55e4ef3a6b499bc5011e5de2f46c4
Fixed
406d05da26835943568e61bb751c569efae071d4
Fixed
a11b8c0be6acd0505a58ff40d474bd778b25b93a
Fixed
5f1f833cb388592bb46104463a1ec1b7c41975b6
Fixed
491deb9b8c4ad12fe51d554a69b8165b9ef9429f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38018.json"