FlawAtlas
Search the atlas
CVE-2025-38566 Not scored

sunrpc: fix handling of server side tls alerts

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

Exploit probability 0.6%
Published August 19, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related ALSA-2025:16354
related ALSA-2025:18281
related OPENSUSE-SU-2025:20081-1
related SUSE-SU-2025:03272-1
related SUSE-SU-2025:03290-1
related SUSE-SU-2025:03301-1
related SUSE-SU-2025:03382-1
related SUSE-SU-2025:03602-1
related SUSE-SU-2025:03633-1
related SUSE-SU-2025:03634-1
related SUSE-SU-2025:03636-1
related SUSE-SU-2025:03638-1
related SUSE-SU-2025:03643-1
related SUSE-SU-2025:03646-1
related SUSE-SU-2025:03650-1
related SUSE-SU-2025:20653-1
related SUSE-SU-2025:20669-1
related SUSE-SU-2025:20739-1
related SUSE-SU-2025:20756-1
related SUSE-SU-2025:20873-1
related SUSE-SU-2025:20874-1
related SUSE-SU-2025:20875-1
related SUSE-SU-2025:20876-1
related SUSE-SU-2025:20877-1
related SUSE-SU-2025:20878-1
related SUSE-SU-2025:20879-1
related SUSE-SU-2025:20880-1
related SUSE-SU-2025:20881-1
related SUSE-SU-2025:20882-1
related SUSE-SU-2025:20883-1
related SUSE-SU-2025:20884-1
related SUSE-SU-2025:20885-1
related SUSE-SU-2025:20886-1
related SUSE-SU-2025:20887-1
related SUSE-SU-2025:20888-1
related SUSE-SU-2025:20889-1
related SUSE-SU-2025:20890-1
related SUSE-SU-2025:20891-1
related SUSE-SU-2025:20902-1
related SUSE-SU-2025:20903-1
related SUSE-SU-2025:20904-1
related SUSE-SU-2025:20905-1
related SUSE-SU-2025:20906-1
related SUSE-SU-2025:20907-1
related SUSE-SU-2025:20908-1
related SUSE-SU-2025:20909-1
related SUSE-SU-2025:20912-1
related SUSE-SU-2025:20913-1
related SUSE-SU-2025:20914-1
related SUSE-SU-2025:20915-1
related SUSE-SU-2025:20916-1
related SUSE-SU-2025:20917-1
related SUSE-SU-2025:20918-1
related SUSE-SU-2025:20919-1
related SUSE-SU-2025:20920-1
related SUSE-SU-2025:21074-1
related SUSE-SU-2025:21139-1
related SUSE-SU-2025:21179-1
related SUSE-SU-2025:3742-1
related SUSE-SU-2025:3748-1
related SUSE-SU-2025:3755-1
related SUSE-SU-2025:3762-1
related SUSE-SU-2025:3764-1
related SUSE-SU-2025:3765-1
related SUSE-SU-2025:3768-1
related SUSE-SU-2025:3770-1
related SUSE-SU-2025:3771-1
related SUSE-SU-2025:3772-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-38566

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

View original source

05 / REFERENCES

Further evidence