CVE-2025-38566: Linux Kernel vulnerability (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel≥ 6.13 < 6.15.10 · ≥ 6.16 < 6.16.1 · ≥ 6.4 < 6.6.102 · ≥ 6.7 < 6.12.42

Remediation

Fixed in

Linux Kernel≥ 6.15.10

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-38566 being actively exploited?

CVE-2025-38566 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.59%.

How severe is CVE-2025-38566?

CVE-2025-38566 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.59% probability of exploitation.

Which products are affected by CVE-2025-38566?

Affected products include Linux Kernel.

How do I fix CVE-2025-38566?

Upgrade affected software to a fixed version, for example Linux Kernel 6.15.10 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-38566 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo