CVE-2025-38471

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tls: always refresh the queue when reading sock

After recent changes in net-next TCP compacts skbs much more

aggressively. This unearthed a bug in TLS where we may try

to operate on an old skb when checking if all skbs in the

queue have matching decrypt state and geometry.

BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls]

(net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544)

Read of size 4 at addr ffff888013085750 by task tls/13529

CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme

Call Trace:

kasan_report+0xca/0x100

tls_strp_check_rcv+0x898/0x9a0 [tls]

tls_rx_rec_wait+0x2c9/0x8d0 [tls]

tls_sw_recvmsg+0x40f/0x1aa0 [tls]

inet_recvmsg+0x1c3/0x1f0

Always reload the queue, fast path is to have the record in the queue

when we wake, anyway (IOW the path going down "if !strp->stm.full_len").

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References