CVE-2025-38571sunrpc: fix client side handling of tls alerts
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from dea034b963c8901bdcc3d3880c04f0d75c95112f before a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95; from dea034b963c8901bdcc3d3880c04f0d75c95112f before c36b2fbd60e8f9c6f975522130998608880c93be; from dea034b963c8901bdcc3d3880c04f0d75c95112f before 3ee397eaaca4fa04db21bb98c8f1d0c6cc525368; from dea034b963c8901bdcc3d3880c04f0d75c95112f before 3feada5baf4dc96e151ff2ca54630e1d274e5458; from dea034b963c8901bdcc3d3880c04f0d75c95112f before cc5d59081fa26506d02de2127ab822f40d88bc5a | CNA record |
linux linux_kernel linux:linux_kernel | from 6.5 before 6.6.102; from 6.7 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1 | NVD |
References
- https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95patch
- https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93bepatch
- https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368patch
- https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458patch
- https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5apatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.