CVE-2025-38471

tls: always refresh the queue when reading sock

State: Published
Severity: 9.8 Critical
Published: Jul 28, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tls: always refresh the queue when reading sock

After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry.

BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529

CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0

Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len").

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 730fed2ff5e259495712518e18d9f521f61972bbAffected 0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 1f3a429c21e0e43e8b8c55d30701e91411a4df02Affected 0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8Affected 0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6Affected 0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 4ab26bce3969f8fd925fe6f6f551e4d1a508c68bAffected 2277d7cbdf47531b2c3cd01ba15255fa955aab35Affected 6.0.6 to before 6.1Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.147 through 6.1.Not affected 6.6.100 through 6.6.Not affected 6.12.40 through 6.12.Not affected 6.15.8 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 730fed2ff5e259495712518e18d9f521f61972bbAffected
0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 1f3a429c21e0e43e8b8c55d30701e91411a4df02Affected
0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8Affected
0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6Affected
0d87bbd39d7fd1135ab9eca672d760470f6508e8 to before 4ab26bce3969f8fd925fe6f6f551e4d1a508c68bAffected
2277d7cbdf47531b2c3cd01ba15255fa955aab35Affected
6.0.6 to before 6.1Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.147 through 6.1.*Not affected
6.6.100 through 6.6.*Not affected
6.12.40 through 6.12.*Not affected
6.15.8 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.