CVE-2025-38616: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38616 Overview

CVE-2025-38616 is a Linux kernel vulnerability in the Transport Layer Security Upper Layer Protocol (TLS ULP) subsystem. The flaw stems from TLS assuming exclusive ownership of the underlying TCP socket receive queue. When another reader consumes data from the queue before the TLS ULP is installed, or uses non-standard read APIs such as zerocopy, the parsing state becomes inconsistent. This condition can trigger an out-of-bounds read [CWE-125] when the kernel decrypts a record with insufficient bytes remaining. The vulnerability affects Linux kernel versions up to and including 6.17-rc1.

Critical Impact
A local, authenticated attacker can trigger out-of-bounds reads in the TLS ULP, corrupting stream state and potentially causing kernel-level denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 6.17-rc1
Systems using kernel TLS (kTLS) offload with TCP sockets

Discovery Timeline

2025-08-22 - CVE-2025-38616 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38616

Vulnerability Analysis

The Linux kernel TLS ULP layer manages record parsing and decryption on top of a TCP socket. TLS logic assumes it exclusively owns the receive queue of that socket. This assumption breaks in two scenarios: a reader consumed data from the TCP socket before the TLS ULP was attached, or a caller invokes non-standard read APIs such as zerocopy receive that bypass the TLS strparser.

When these conditions occur, the previously cached anchor pointer references an sk_buff that has been freed or advanced. The original code responded with a WARN_ON() and an early exit that left the anchor pointing to invalid memory. The fix replaces this with proper error handling that wipes the parsing state and asks the reader to retry.

Root Cause

The root cause is an unchecked assumption about socket queue ownership combined with stale parser state. The anchor is reloaded on every socket lock reacquisition, but the code did not validate that enough bytes remained in the queue to satisfy a previously parsed record length. This creates the conditions for an out-of-bounds read against a freed or truncated skb.

Attack Vector

Exploitation requires local access with an authenticated user context capable of establishing kTLS sockets. An attacker arranges for a TCP reader to consume queue data before the TLS ULP takes over, or invokes zerocopy receive semantics against a kTLS socket. The resulting state confusion drives TLS record decryption over unexpected byte ranges. The consequence is undefined TLS behavior including corrupted streams, missed alerts, or missed attack indicators, and possible kernel memory disclosure via the out-of-bounds read.

No public proof-of-concept exploit code is available for CVE-2025-38616. Technical details are documented in the upstream commits referenced by the Linux stable kernel Git repository.

Detection Methods for CVE-2025-38616

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from net/tls/tls_strp.c or related TLS ULP functions on unpatched systems.
Repeated TLS record decryption failures on sockets that also show non-standard receive patterns such as MSG_ZEROCOPY usage.
Unexpected TCP socket state transitions on processes attaching the TLS ULP after data has already been received.

Detection Strategies

Audit kernel versions across the fleet and flag hosts running kernels prior to the stable commits listed in the upstream advisory.
Correlate kernel dmesg output for TLS subsystem warnings with process telemetry that shows workloads using kTLS offload.
Monitor for anomalous kernel oops or panic events on hosts serving TLS-terminating workloads such as web proxies, TLS load balancers, or storage services.

Monitoring Recommendations

Ingest kernel logs and syslog into a centralized data lake and alert on TLS-related WARN or BUG signatures.
Track process behavior for unprivileged users invoking setsockopt(TCP_ULP, "tls") combined with unusual read patterns.
Baseline kTLS usage per host and alert on new processes attaching the TLS ULP outside of expected service accounts.

How to Mitigate CVE-2025-38616

Immediate Actions Required

Inventory Linux hosts using kernel TLS and prioritize patching servers that terminate TLS at the kernel level.
Apply vendor-supplied kernel updates that incorporate the upstream fix for the TLS ULP anchor handling.
Restrict the ability of untrusted local users to establish kTLS sockets on multi-tenant systems.

Patch Information

The fix is available in the upstream Linux stable tree across multiple branches. Reference the following commits:

Distributions including Red Hat, SUSE, Debian, Ubuntu, and Amazon Linux typically backport these commits. Consult your distribution's security tracker for the exact package version containing the fix.

Workarounds

Disable kernel TLS offload where feasible and terminate TLS in userspace libraries such as OpenSSL until patching is complete.
Avoid mixing pre-ULP TCP readers with the TLS ULP on the same socket in application code.
Refrain from using zerocopy receive APIs on sockets that will later attach the TLS ULP.

bash

# Verify kernel version and confirm patch presence
uname -r
# Check whether kTLS module is loaded and in use
lsmod | grep tls
# Optional: prevent tls module autoload as a temporary workaround
echo "install tls /bin/true" | sudo tee /etc/modprobe.d/disable-ktls.conf