Data Corruption Vulnerability in Linux Kernel's BPF with KTLS - CVE-2025-38608
Summary
CVE-2025-38608: In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext l... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports various functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance, but vulnerabilities can lead to severe security risks. This specific vulnerability affects the kernel's BPF (Berkeley Packet Filter) and KTLS (Kernel TLS) functionalities, which are used for secure data transmission over networks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the BPF and KTLS components, specifically related to the function bpf_msg_pop_data(). When sending plaintext data, the system initially calculates the corresponding ciphertext length. However, if the plaintext data length is later reduced via socket policy, the system fails to recalculate the ciphertext length. This oversight results in transmitting buffers that contain uninitialized data during ciphertext transmission. Consequently, uninitialized bytes may be appended after a complete 'Application Data' packet, leading to errors on the receiving end when parsing TLS records. This vulnerability can potentially expose sensitive data and disrupt secure communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can mitigate the risk by avoiding the use of BPF with KTLS for sensitive data transmissions until the patch is applied. Additionally, monitoring network traffic for anomalies may help identify any potential exploitation attempts.
Conclusion
CVE-2025-38608 represents a significant vulnerability in the Linux kernel that can lead to data corruption during secure transmissions. It is crucial for users to update their systems to the latest patched version to mitigate the risks associated with this vulnerability. Understanding and addressing such vulnerabilities is essential for maintaining secure and reliable systems.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38608 is a vulnerability in the Linux kernel's BPF and KTLS functionalities that can lead to data corruption during secure data transmission.
This vulnerability can result in the transmission of uninitialized data, potentially exposing sensitive information and causing errors in secure communications.
Yes, a patch is available. Users should update their Linux package to the latest version to ensure they have the fix.
If immediate updates are not possible, consider avoiding the use of BPF with KTLS for sensitive data and monitor network traffic for any unusual activity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by CVE-2025-38608 without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
