TLS Alert Handling Vulnerability in Linux Kernel - CVE-2025-38571
Summary
DEBIAN-CVE-2025-38571: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is v... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports various functionalities, including process management, memory management, and device control. This vulnerability specifically affects the handling of TLS alerts in NFS over TLS, which can lead to potential security exploits if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the handling of TLS alerts within the NFS over TLS implementation. The issue arises from the assumption that valid data exists in the msghdr's iterator's kvec, which can lead to improper processing of TLS control messages. If the control message structure is not set up correctly, the kTLS layer may misinterpret TLS data record types, resulting in errors and potential security breaches. This vulnerability could allow unauthorized access or manipulation of data transmitted over secure channels.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using NFS over TLS until the package is updated to the patched version. This may involve switching to alternative file-sharing protocols that do not rely on TLS.
Conclusion
The CVE-2025-38571 vulnerability in the Linux kernel poses a significant risk to systems using NFS over TLS. It is crucial to apply the available patches promptly to mitigate potential security threats. Users should also consider alternative protocols until the updates are implemented.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38571 is a vulnerability in the Linux kernel that affects the handling of TLS alerts in NFS over TLS, potentially leading to security exploits.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could allow unauthorized access to sensitive data transmitted over TLS, leading to data breaches or manipulation.
Yes, patches are available for Debian 13 (version 6.12.43-1) and Debian 14 (version 6.16.3-1) to fix this vulnerability.
As a temporary measure, consider avoiding the use of NFS over TLS until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
