CVE-2025-38608

A flaw was found in the Linux kernel's kernel Transport Layer Security (kTLS) component. When plaintext data length is reduced through socket policy, the system fails to correctly recalculate the ciphertext length. This can lead to the transmission of uninitialized data appended to Transport Layer Security (TLS) records, causing errors and potentially a Denial of Service (DoS) on the receiving end.

A low-impact flaw was found in the Linux kernel's kernel Transport Layer Security (kTLS) implementation in Red Hat Enterprise Linux 8, 9, and 10. When a BPF socket policy such as bpf_msg_pop_data() reduces the length of plaintext data after the corresponding ciphertext length has already been calculated, the ciphertext length is not recalculated. As a result, buffers containing uninitialized data may be transmitted after a complete TLS Application Data record, causing errors when the receiving end parses the TLS record and potentially resulting in a denial of service. Triggering this flaw requires a local privileged user to attach a BPF sk_msg program to a kTLS socket and reduce the plaintext length via socket policy, and the impact is limited to availability; Red Hat rates this flaw LOW severity (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). This differs from the CVE.org record, which assigns a score of 8.6 based on a network attack vector and confidentiality and integrity impacts; Red Hat's assessment reflects the local high-privilege prerequisites and the availability-only consequence of this flaw. Fixes for the affected RHEL 8, 9, and 10 kernel and kernel-rt streams are deferred given the low impact and the narrow conditions required to trigger the flaw, leaving residual risk of corrupted TLS records and connection errors on kTLS connections where a BPF socket policy reduces the plaintext length. Red Hat Enterprise Linux 6 and 7 and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.