CVE-2025-38608

What it actually does

Failure to recalculate ciphertext length after bpf_msg_pop_data reduces plaintext in ktls results in transmission of kernel buffers containing uninitialized bytes appended to TLS Application Data records.

Why it matters to the business

Potential leakage of kernel memory contents over TLS connections on affected Linux systems and dependent packages can cause parsing errors, connection failures, or exposure of sensitive data; widespread presence in container and JDK environments increases operational risk and patching urgency across many deployments.

How an attack unfolds

An attacker positions a BPF program to invoke bpf_msg_pop_data on ktls sockets during plaintext transmission; the missing ciphertext recalculation causes uninitialized data to be sent in the TLS record, which remote peers may observe or which can be triggered in targeted container environments by actors such as Advanced Spyware Campaign or those exploiting related Linux kernel issues on Container-Optimized OS.

How to fix it

Upgrade the Linux kernel to commit 6ba20ff3cdb96a908b9dc93cf247d0b087672e7c or later; for Chainguard packages update openjdk-11-openj9 and related variants to 0.53.0-r0; rebuild and redeploy affected containers after patching.

How to confirm the fix worked

Verify kernel version or package version against fixed releases; confirm absence of the described length-calculation path in ktls/BPF code; test TLS record transmission with bpf_msg_pop_data under socket policies.

Typical attack path

1. Identify systems running vulnerable kernel versions with ktls and BPF enabled
2. Deploy or coerce a BPF program that reduces message length via bpf_msg_pop_data on ktls sockets
3. Trigger transmission of TLS Application Data
4. Observe or capture appended uninitialized bytes on the receiving side

How to detect it

Review receiver-side TLS parsing errors and kernel logs for ktls/BPF activity; search for use of bpf_msg_pop_data in socket policies; correlate with threat actor campaigns targeting Container-Optimized OS privilege escalation paths.

What your security team should do

• Apply kernel and package updates immediately given 434 days since publication and ongoing EPSS trend
• Prioritize environments using ktls with BPF programs, especially Container-Optimized OS
• Monitor for related exploitation by listed threat actors and test container images for the listed Chainguard packages
• Disable ktls or BPF socket policies where not required until patched