Skip to content
OpenAdvisories
High · 7.8 CVE-2025-38616 EUVD-2025-26087GHSA-jwf8-43xw-qvcr

tls: handle data disappearing from under the TLS ULP

Published Aug 22, 2025 · Updated Aug 27, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

tls: handle data disappearing from under the TLS ULP

TLS expects that it owns the receive queue of the TCP socket.
This cannot be guaranteed in case the reader of the TCP socket
entered before the TLS ULP was installed, or uses some non-standard
read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy
early exit (which leaves anchor pointing to a freed skb) with real
error handling. Wipe the parsing state and tell the reader to retry.

We already reload the anchor every time we (re)acquire the socket lock,
so the only condition we need to avoid is an out of bounds read
(not having enough bytes in the socket for previously parsed record len).

If some data was read from under TLS but there's enough in the queue
we'll reload and decrypt what is most likely not a valid TLS record.
Leading to some undefined behavior from TLS perspective (corrupting
a stream? missing an alert? missing an attack?) but no kernel crash
should take place.

Affected products

VendorProductAffectedFixed
Linux Linux 6.0 6.1.185

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.16.3-1 —
Debian 13 linux 6.12.43-1 —
Debian 12 linux 6.1.187-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1013.17 —
Ubuntu 25.10 linux-azure-fde No fix yet —
Ubuntu 24.04 LTS linux 6.8.0-88.89 USN-7889-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1043.45 USN-7889-1
Ubuntu 24.04 LTS linux-aws-6.14 +2 6.14.0-1017.17~24.04.1 USN-7934-1, USN-7879-3
Ubuntu 24.04 LTS linux-azure 6.8.0-1044.50 USN-7935-1
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1046.53 —
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1029.32 USN-7940-2
Ubuntu 24.04 LTS linux-gcp 6.8.0-1044.47 USN-7889-4
Ubuntu 24.04 LTS linux-gcp-6.14 6.14.0-1020.21~24.04.1 USN-7879-4
Ubuntu 24.04 LTS linux-gke 6.8.0-1040.45 USN-7889-4
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1027.30 USN-7889-4
Ubuntu 24.04 LTS linux-hwe-6.14 6.14.0-36.36~24.04.1 USN-7879-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1041.41 USN-7889-1
Ubuntu 24.04 LTS linux-intel +12 No fix yet —
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-88.89.1 USN-7889-1
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1043.46 USN-7889-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1043.46.1 USN-7889-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1013.13 —
Ubuntu 24.04 LTS linux-oem-6.14 6.14.0-1016.16 USN-7880-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1040.41 USN-7889-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1043.47 USN-7889-7
Ubuntu 24.04 LTS linux-riscv-6.14 6.14.0-36.36.1~24.04.1 —
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1020.21 USN-7889-7
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1043.45~22.04.1 USN-7889-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1044.50~22.04.1 USN-7935-1
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1046.53~22.04.1 —
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1044.47~22.04.1 USN-7889-4
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-88.89~22.04.2 USN-7889-6
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1041.41~22.04.1 USN-7889-5
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-88.89.1~22.04.1 USN-7889-1
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1043.46~22.04.1 USN-7889-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1040.41~22.04.1 USN-7889-6
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 6.8.0-88.89~22.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2034.35 USN-7889-7
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1038.39 USN-7889-3
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 6.14.0-1016.16~24.04.1 USN-7879-2
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1038.39~22.04.1 USN-7889-3
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1043.45+fips1 USN-7889-2
Ubuntu Pro FIPS-updates 24.04 LTS linux-azure-fips 6.8.0-1044.50+fips1 USN-7940-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-88.89+fips1 USN-7889-2
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips 6.8.0-1044.47+fips1 USN-7889-2
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.19.1 SUSE-SU-2025:03601-1
SLES 15 SP7 kernel-azure +1 6.4.0-150700.20.15.2 SUSE-SU-2025:03633-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.19.1.150700.17.13.1 SUSE-SU-2025:03601-1
SLES 15 SP7 kernel-syms-azure 6.4.0-150700.20.15.1 SUSE-SU-2025:03633-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.73.1 SUSE-SU-2025:03600-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.52.1 SUSE-SU-2025:03634-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.73.1.150600.12.32.1 SUSE-SU-2025:03600-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +7 6.12.0-160000.6.1 SUSE-SU-2025:21139-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21139-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_0 5-160000.4.3 SUSE-SU-2026:20149-1
SLES 16.0 kernel-64kb +7 6.12.0-160000.6.1 SUSE-SU-2025:21179-1, SUSE-SU-2025:21139-1
SLES 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21139-1
SLES 16.0 kernel-livepatch-SLE16_Update_0 5-160000.4.3 SUSE-SU-2026:20149-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21074-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_0 4-160000.3.4 SUSE-SU-2026:20164-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_0 5-160000.4.3 SUSE-SU-2026:20169-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.6.1 SUSE-SU-2026:20560-1, SUSE-SU-2025:21074-1
SLE Micro 6.1 kernel-default-base 6.4.0-35.1.21.12 SUSE-SU-2025:20861-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_10 8-1.1 SUSE-SU-2025:21122-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_4 13-1.1 SUSE-SU-2025:21116-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_5 12-1.1 SUSE-SU-2025:21117-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_7 10-1.3 SUSE-SU-2025:21119-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_9 8-1.2 SUSE-SU-2025:21121-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_10 +1 4-1.1 SUSE-SU-2025:21123-1, SUSE-SU-2025:21114-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_11 +2 3-1.1 SUSE-SU-2025:21124-1, SUSE-SU-2025:21115-1, SUSE-SU-2025:21113-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_4 14-1.2 SUSE-SU-2025:21107-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_5 12-1.2 SUSE-SU-2025:21108-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_6 +1 10-3.1 SUSE-SU-2025:21118-1, SUSE-SU-2025:21109-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_7 +3 9-1.2 SUSE-SU-2025:21120-1, SUSE-SU-2025:21112-1, SUSE-SU-2025:21111-1
SLE Micro 6.1 kernel-rt +1 6.4.0-37.1 SUSE-SU-2025:20898-1
SLE Micro 6.1 kernel-source +2 6.4.0-35.1 SUSE-SU-2025:20861-1
SLE Micro 6.0 kernel-default-base 6.4.0-35.1.21.12 SUSE-SU-2025:20851-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_10 8-1.1 SUSE-SU-2025:21099-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_4 13-1.1 SUSE-SU-2025:21086-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_5 12-1.1 SUSE-SU-2025:21087-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_7 10-1.3 SUSE-SU-2025:21089-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_9 8-1.2 SUSE-SU-2025:21091-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_10 +1 4-1.1 SUSE-SU-2025:21103-1, SUSE-SU-2025:21100-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_11 +2 3-1.1 SUSE-SU-2025:21104-1, SUSE-SU-2025:21102-1, SUSE-SU-2025:21101-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_3 +1 16-1.2 SUSE-SU-2025:21092-1, SUSE-SU-2025:21085-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_4 14-1.2 SUSE-SU-2025:21093-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_5 12-1.2 SUSE-SU-2025:21094-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_6 +1 10-3.1 SUSE-SU-2025:21095-1, SUSE-SU-2025:21088-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_7 +3 9-1.2 SUSE-SU-2025:21098-1, SUSE-SU-2025:21097-1, SUSE-SU-2025:21096-1
SLE Micro 6.0 kernel-rt +1 6.4.0-37.1 SUSE-SU-2025:20870-1
SLE Micro 6.0 kernel-source +2 6.4.0-35.1 SUSE-SU-2025:20851-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.19.1 SUSE-SU-2025:03601-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_0 8-150700.3.1 SUSE-SU-2025:4167-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_5 1-150700.1.3.1 SUSE-SU-2025:3725-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_0 8-150700.3.21.2 SUSE-SU-2025:4302-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_1 +2 8-150700.2.1 SUSE-SU-2025:4306-1, SUSE-SU-2025:4208-1, SUSE-SU-2025:4164-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_4 +1 4-150700.2.1 SUSE-SU-2025:4311-1, SUSE-SU-2025:4169-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_5 1-150700.15.3.1 SUSE-SU-2025:03601-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.73.1 SUSE-SU-2025:03600-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_16 1-150600.1.3.1 SUSE-SU-2025:3751-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_5 19-150600.2.1 SUSE-SU-2025:4161-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_9 11-150600.2.1 SUSE-SU-2025:4160-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_10 +1 10-150600.2.1 SUSE-SU-2025:4265-1, SUSE-SU-2025:4200-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_11 +2 9-150600.2.1 SUSE-SU-2025:4282-1, SUSE-SU-2025:4269-1, SUSE-SU-2025:4164-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_13 +1 8-150600.2.1 SUSE-SU-2025:4268-1, SUSE-SU-2025:4201-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_15 +1 4-150600.2.1 SUSE-SU-2025:4275-1, SUSE-SU-2025:4208-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_16 1-150600.13.3.1 SUSE-SU-2025:03600-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_6 +2 16-150600.2.1 SUSE-SU-2025:4262-1, SUSE-SU-2025:4261-1, SUSE-SU-2025:4167-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.19.1 SUSE-SU-2025:3725-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.55.1 SUSE-SU-2025:3751-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 openSUSE-SU-2025:20081-1
openSUSE Leap 16.0 kernel-rt +10 6.12.0-160000.6.1 openSUSE-SU-2025:20081-1
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.73.1 SUSE-SU-2025:03600-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.52.1 SUSE-SU-2025:03634-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.73.1.150600.12.32.1 SUSE-SU-2025:03600-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.55.1 SUSE-SU-2025:3751-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.12.46-66.121 1:1.0-0.amzn2023 ALAS2023-2025-1208
Amazon Linux 2023 perf6.12 +14 1:6.12.46-66.121.amzn2023 ALAS2023-2025-1208

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel 6.6.104.2-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-104.43.4.2.el10uek ELSA-2025-20662

Advisories 50

References