CVE-2025-38571
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's handling of TLS alerts on the client side for NFS over TLS. The issue arises because the code incorrectly assumes that there is valid data in the message header's iterator's kvec. This leads to improper processing of TLS control messages, such as TLS alerts, which can cause errors or unexpected behavior. The fix involves reworking how control messages are set up and used by sock_recvmsg(), ensuring that the message iterator is correctly managed before processing TLS alerts.
How can this vulnerability impact me? :
This vulnerability could lead to errors or failures in the processing of TLS alerts in NFS over TLS connections, potentially causing disruptions or denial of service in network file system communications secured by TLS. It may allow an attacker to exploit the improper handling of TLS alerts to interfere with secure communications.