CVE-2025-38616

A flaw was found in the Linux kernel's in-kernel TLS (kTLS) receive path. This vulnerability, a race condition, allows data to be consumed from the TCP socket before the kTLS component fully takes control. A local attacker with privileged access to kTLS socket setup could exploit this timing issue, causing the system's internal data processing to reference invalid memory. This could lead to a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

A race in the in-kernel TLS (kTLS) receive path allowed data to be consumed from the TCP socket before the TLS ULP took ownership, leaving internal parsing state pointing to freed buffers and potentially crashing the kernel. The fix replaces a WARN/early-exit with proper error handling: it resets the parsing state and forces a retry when the queue has changed under TLS. Practical exploitation requires local, typically privileged control over kTLS socket setup and precise timing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.