Junglewise Threat Intelligence

CVE-2025-38471: Linux Kernel use-after-free in TLS socket read

CVE-2025-38471 · Severity: high · CVSS 7.8 · Published 2025-07-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's TLS (Transport Layer Security) implementation could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system processes network data packets that have been reorganized, leading to a memory error. This could result in a complete system failure or the exposure of sensitive information handled by the kernel.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's TLS implementation within net/tls/tls_strp.c. The root cause is a failure to refresh the socket queue when reading data, which becomes problematic when TCP aggressively compacts socket buffer (skb) structures. This leads to the kernel operating on stale skb references in tls_strp_check_rcv, resulting in a slab-use-after-free. An attacker with local access could exploit this to cause a kernel panic (DoS) or potentially achieve arbitrary code execution. Patches have been released across multiple stable kernel branches to ensure the queue is reloaded during socket reads.

Affected products

  • Linux Linux Kernel 6.13 to 6.15.8, 6.7 to 6.12.40, 6.2 to 6.6.100, 6.1.1 to 6.1.147, 6.0.6 to 6.1

Timeline

  • 2025-07-16: patched: Initial patch submitted by Jakub Kicinski
  • 2025-07-28: disclosed: CVE-2025-38471 published

References

Related threats