Executive brief
A vulnerability was identified in the Linux kernel's handling of encrypted network file sharing (NFS over TLS). The flaw exists in how the system processes security alerts during encrypted communications, which could allow an attacker to disrupt network services or potentially access sensitive information. This affects systems using the SUNRPC component for remote procedure calls over secure connections. Patches have been released to correct how the system manages these internal security messages.
Technical details
A vulnerability exists in the Linux kernel's SUNRPC implementation, specifically within the client-side handling of TLS alerts in 'net/sunrpc/xprtsock.c'. The 'tls_alert_recv' function incorrectly assumed the presence of valid data in the msghdr's iterator kvec. During the copy process, a message iterator could advance the kvec pointer, leading to memory safety issues when 'tls_alert_recv' is subsequently called. The fix reworks how control messages are initialized and used by 'sock_recvmsg()', ensuring the iterator is reverted before processing TLS alerts. This affects kernels from version 6.5 onwards that implement SUNRPC CMSG metadata capture.
Affected products
- Linux Linux Kernel 6.5 to 6.6.101, 6.7 to 6.12.41, 6.13 to 6.15.9, 6.16 to 6.16.0
Timeline
- 2025-07-31: patched: Initial fix developed by Olga Kornievskaia
- 2025-08-15: patched: Commits merged into stable branches
- 2025-08-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368
- https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458
- https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95
- https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93be
- https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5a