CVE-2025-38566

What it actually does

The sunrpc layer's tls_alert_recv() incorrectly assumes it can read TLS alert payload directly from the msg iterator's kvec; kTLS splits non-data records between control message buffer and payload buffer, allowing improper input validation when no control message structure is pre-allocated.

Why it matters to the business

Organizations running NFS over TLS on affected Linux kernels face risk of server-side exploitation that can lead to privilege escalation or service disruption, especially in containerized environments; the large number of downstream kernel dependents increases exposure across fleets, with remediation deadlines adding operational urgency.

How an attack unfolds

An attacker sends a crafted TLS non-data record (alert) to an NFS-over-TLS server; because sock_recvmsg() lacks a pre-setup control message kvec, kTLS returns an error on encountering the control record; the subsequent tls_alert_recv() call then operates on an uninitialized or advanced iterator, enabling the security exploit. Threat actors have targeted similar Linux kernel privilege escalation issues on Container-Optimized OS.

How to fix it

Upgrade the Linux kernel to commit b1df394621710b312f0393e3f240fdac0764f968 or later; for listed Chainguard packages apply openjdk-11-openj9 0.53.0-r0 or newer. Rebuild and reboot systems using the fixed kernel; verify NFS-over-TLS configurations after patching.

How to confirm the fix worked

Confirm kernel version contains commit b1df394621710b312f0393e3f240fdac0764f968; test that sock_recvmsg() now properly allocates control message buffers before processing TLS alerts; run regression tests on NFS-over-TLS alert handling paths.

Typical attack path

1. Establish NFS-over-TLS connection to target server
2. Send TLS alert record split across control and payload buffers
3. Trigger sock_recvmsg() without control message kvec
4. Force tls_alert_recv() to read from advanced or invalid kvec iterator
5. Achieve out-of-bounds read or invalid state leading to privilege escalation

How to detect it

Review kernel logs for unexpected errors from tls_alert_recv or sock_recvmsg during NFS-over-TLS sessions; look for abnormal TLS alert processing on servers; correlate with privilege escalation attempts reported by threat actors exploiting similar Linux kernel issues on Container-Optimized OS.

What your security team should do

• Immediately inventory all systems running affected kernel versions and prioritize patching of internet-facing or container-optimized hosts
• Apply the exact fixed commit or package versions listed for each distribution
• Monitor for similar TLS control message handling issues in sunrpc and kTLS
• Test NFS-over-TLS functionality in staging before production rollout