CVE-2025-38566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38566", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.025Z", "datePublished": "2025-08-19T17:02:42.506Z", "dateUpdated": "2026-10-15T21:52:19.466Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:56.367Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix handling of server side tls alerts\n\nScott Mayhew discovered a security exploit in NFS over TLS in\ntls_alert_recv() due to its assumption it can read data from\nthe msg iterator's kvec..\n\nkTLS implementation splits TLS non-data record payload between\nthe control message buffer (which includes the type such as TLS\naler or TLS cipher change) and the rest of the payload (say TLS\nalert's level/description) which goes into the msg payload buffer.\n\nThis patch proposes to rework how control messages are setup and\nused by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a\nkvec backed msg buffer and read in the control message such as a\nTLS alert. Msg iterator can advance the kvec pointer as a part of\nthe copy process thus we need to revert the iterator before calling\ninto the tls_alert_recv."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is nfsd's server-side RPC-over-TLS receive path (net/sunrpc/svcsock.c), driven entirely by TLS records arriving on the TCP/2049 listener; a remote peer triggers it by sending a TLS alert record.\nAC:L - The attacker deterministically controls every precondition \u2014 complete the TLS handshake, send exactly 2 bytes of an RPC fragment marker to set sk_tcplen=2, then send any TLS alert, which exactly consumes the 2-byte kvec and forces the iterator past the end of the stack array; it can be repeated on unlimited connections.\nPR:N - svcauth_tls_accept() processes the AUTH_TLS STARTTLS probe on the NULL procedure with no credentials, and svc_tcp_handshake_done() enables kTLS even when the peer presents no certificate (TLS_NO_PEERID); export/mtls policy is only enforced far later, so the bug is reachable entirely pre-authentication.\nUI:N - The nfsd service threads process incoming TLS records autonomously; no local user or administrator action is needed once the server is listening.\nS:U - The out-of-bounds read and pointer dereference occur within the kernel's own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - tls_alert_recv() reads kernel memory through an out-of-bounds kvec element (stack contents reinterpreted as a pointer) and, in the bvec path, through a struct page * reinterpreted as a data buffer \u2014 an unbounded-address kernel read whose result is reflected back to the attacker as an observable connection-teardown oracle (-ENOTCONN vs -EAGAIN).\nI:H - This is a genuine type confusion (struct bio_vec / stale stack memory consumed as struct kvec) plus an out-of-bounds array access, and attacker-supplied alert bytes are written into kernel RPC state (svsk->sk_marker, rq_pages) outside the protocol's intended flow, with the confused read steering kernel control flow.\nA:H - Dereferencing the pointer-sized value read past the end of the stack-allocated kvec (frequently NULL or a non-canonical/unmapped address) faults inside an nfsd service thread, producing a kernel oops and taking down the NFS server."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/svcsock.c"], "versions": [{"version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "b1df394621710b312f0393e3f240fdac0764f968", "status": "affected", "versionType": "git"}, {"version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "25bb3647d30a20486b5fe7cff2b0e503c16c9692", "status": "affected", "versionType": "git"}, {"version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "3b549da875414989f480b66835d514be80a0bd9c", "status": "affected", "versionType": "git"}, {"version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "6b33c31cc788073bfbed9297e1f4486ed73d87da", "status": "affected", "versionType": "git"}, {"version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "bee47cb026e762841f3faece47b51f985e215edb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/svcsock.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.102", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.42", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.10", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.102"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.16.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f968"}, {"url": "https://git.kernel.org/stable/c/25bb3647d30a20486b5fe7cff2b0e503c16c9692"}, {"url": "https://git.kernel.org/stable/c/3b549da875414989f480b66835d514be80a0bd9c"}, {"url": "https://git.kernel.org/stable/c/6b33c31cc788073bfbed9297e1f4486ed73d87da"}, {"url": "https://git.kernel.org/stable/c/bee47cb026e762841f3faece47b51f985e215edb"}], "title": "sunrpc: fix handling of server side tls alerts", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:44.870495Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:19.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:44.870495Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:45.661Z"}}], "cna": {"title": "sunrpc: fix handling of server side tls alerts", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is nfsd's server-side RPC-over-TLS receive path (net/sunrpc/svcsock.c), driven entirely by TLS records arriving on the TCP/2049 listener; a remote peer triggers it by sending a TLS alert record.\nAC:L - The attacker deterministically controls every precondition \u2014 complete the TLS handshake, send exactly 2 bytes of an RPC fragment marker to set sk_tcplen=2, then send any TLS alert, which exactly consumes the 2-byte kvec and forces the iterator past the end of the stack array; it can be repeated on unlimited connections.\nPR:N - svcauth_tls_accept() processes the AUTH_TLS STARTTLS probe on the NULL procedure with no credentials, and svc_tcp_handshake_done() enables kTLS even when the peer presents no certificate (TLS_NO_PEERID); export/mtls policy is only enforced far later, so the bug is reachable entirely pre-authentication.\nUI:N - The nfsd service threads process incoming TLS records autonomously; no local user or administrator action is needed once the server is listening.\nS:U - The out-of-bounds read and pointer dereference occur within the kernel's own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - tls_alert_recv() reads kernel memory through an out-of-bounds kvec element (stack contents reinterpreted as a pointer) and, in the bvec path, through a struct page * reinterpreted as a data buffer \u2014 an unbounded-address kernel read whose result is reflected back to the attacker as an observable connection-teardown oracle (-ENOTCONN vs -EAGAIN).\nI:H - This is a genuine type confusion (struct bio_vec / stale stack memory consumed as struct kvec) plus an out-of-bounds array access, and attacker-supplied alert bytes are written into kernel RPC state (svsk->sk_marker, rq_pages) outside the protocol's intended flow, with the confused read steering kernel control flow.\nA:H - Dereferencing the pointer-sized value read past the end of the stack-allocated kvec (frequently NULL or a non-canonical/unmapped address) faults inside an nfsd service thread, producing a kernel oops and taking down the NFS server."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "b1df394621710b312f0393e3f240fdac0764f968", "versionType": "git"}, {"status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "25bb3647d30a20486b5fe7cff2b0e503c16c9692", "versionType": "git"}, {"status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "3b549da875414989f480b66835d514be80a0bd9c", "versionType": "git"}, {"status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "6b33c31cc788073bfbed9297e1f4486ed73d87da", "versionType": "git"}, {"status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "lessThan": "bee47cb026e762841f3faece47b51f985e215edb", "versionType": "git"}], "programFiles": ["net/sunrpc/svcsock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.102", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.42", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.10", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.1", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sunrpc/svcsock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f968"}, {"url": "https://git.kernel.org/stable/c/25bb3647d30a20486b5fe7cff2b0e503c16c9692"}, {"url": "https://git.kernel.org/stable/c/3b549da875414989f480b66835d514be80a0bd9c"}, {"url": "https://git.kernel.org/stable/c/6b33c31cc788073bfbed9297e1f4486ed73d87da"}, {"url": "https://git.kernel.org/stable/c/bee47cb026e762841f3faece47b51f985e215edb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix handling of server side tls alerts\n\nScott Mayhew discovered a security exploit in NFS over TLS in\ntls_alert_recv() due to its assumption it can read data from\nthe msg iterator's kvec..\n\nkTLS implementation splits TLS non-data record payload between\nthe control message buffer (which includes the type such as TLS\naler or TLS cipher change) and the rest of the payload (say TLS\nalert's level/description) which goes into the msg payload buffer.\n\nThis patch proposes to rework how control messages are setup and\nused by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a\nkvec backed msg buffer and read in the control message such as a\nTLS alert. Msg iterator can advance the kvec pointer as a part of\nthe copy process thus we need to revert the iterator before calling\ninto the tls_alert_recv."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.102", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.42", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.1", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "6.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:56.367Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38566", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:19.466Z", "dateReserved": "2025-04-16T04:51:24.025Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-19T17:02:42.506Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/svcsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b1df394621710b312f0393e3f240fdac0764f968", "status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "versionType": "git"}, {"lessThan": "25bb3647d30a20486b5fe7cff2b0e503c16c9692", "status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "versionType": "git"}, {"lessThan": "3b549da875414989f480b66835d514be80a0bd9c", "status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "versionType": "git"}, {"lessThan": "6b33c31cc788073bfbed9297e1f4486ed73d87da", "status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "versionType": "git"}, {"lessThan": "bee47cb026e762841f3faece47b51f985e215edb", "status": "affected", "version": "5e052dda121e2870dd87181783da4a95d7d2927b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/svcsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.102", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.42", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.10", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BCA0ECA-F7A2-42B6-A438-0891D46073AD", "versionEndExcluding": "6.6.102", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA7AA5E6-4376-4A85-A021-6ACC5FF801C3", "versionEndExcluding": "6.12.42", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142", "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB", "versionEndExcluding": "6.16.1", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix handling of server side tls alerts\n\nScott Mayhew discovered a security exploit in NFS over TLS in\ntls_alert_recv() due to its assumption it can read data from\nthe msg iterator's kvec..\n\nkTLS implementation splits TLS non-data record payload between\nthe control message buffer (which includes the type such as TLS\naler or TLS cipher change) and the rest of the payload (say TLS\nalert's level/description) which goes into the msg payload buffer.\n\nThis patch proposes to rework how control messages are setup and\nused by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a\nkvec backed msg buffer and read in the control message such as a\nTLS alert. Msg iterator can advance the kvec pointer as a part of\nthe copy process thus we need to revert the iterator before calling\ninto the tls_alert_recv."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sunrpc: correcci\u00f3n del manejo de las alertas tls del lado del servidor Scott Mayhew descubri\u00f3 un exploit de seguridad en NFS sobre TLS en tls_alert_recv() debido a su suposici\u00f3n de que puede leer datos del kvec del iterador msg. La implementaci\u00f3n de kTLS divide el payload del registro no de datos de TLS entre el b\u00fafer de mensajes de control (que incluye el tipo como la alerta TLS o el cambio de cifrado TLS) y el resto del payload (por ejemplo, el nivel/descripci\u00f3n de la alerta TLS) que va al b\u00fafer de payload msg. Este parche propone volver a trabajar c\u00f3mo se configuran y utilizan los mensajes de control por sock_recvmsg(). Si no se configura ninguna estructura de mensaje de control, la capa kTLS leer\u00e1 y procesar\u00e1 los tipos de registros de datos TLS. Tan pronto como encuentre un mensaje de control TLS, devolver\u00e1 un error. En ese punto, NFS puede configurar un b\u00fafer de mensajes respaldado por kvec y leer el mensaje de control como una alerta TLS. El iterador Msg puede avanzar el puntero kvec como parte del proceso de copia, por lo tanto, debemos revertir el iterador antes de llamar a tls_alert_recv."}], "id": "CVE-2025-38566", "lastModified": "2026-10-15T22:18:45.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38566", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:51:44.870495Z", "version": "2.0.3"}}]}, "published": "2025-08-19T17:15:33.230", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/25bb3647d30a20486b5fe7cff2b0e503c16c9692"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b549da875414989f480b66835d514be80a0bd9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b33c31cc788073bfbed9297e1f4486ed73d87da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f968"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bee47cb026e762841f3faece47b51f985e215edb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sunrpc: fix handling of server side tls alerts", "id": "2389487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2389487"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38566", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38566\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38566\nhttps://lore.kernel.org/linux-cve-announce/2025081908-CVE-2025-38566-edef@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-08-21T12:31:57.479912+00:00", "updated": "2025-08-21T12:31:57.479963+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}