CVE-2025-6395

What it actually does

NULL pointer dereference in GnuTLS _gnutls_figure_common_ciphersuite() during TLS handshake processing that crashes the process or corrupts memory state.

Why it matters to the business

Applications relying on GnuTLS for encrypted connections can be forced offline, interrupting services and requiring restarts or patching across Linux deployments.

How an attack unfolds

An attacker initiates a TLS connection with a specially crafted ClientHello that reaches the vulnerable ciphersuite selection path, triggering the NULL dereference and causing a crash or denial of service.

How to fix it

Upgrade linux-lts packages to the fixed versions: 6.1.81-r0 for Alpaquita:23, 6.6.58-r0 or 6.12.41-r0 for stream, and 6.12.41-r0 for 25; restart affected services after update.

How to confirm the fix worked

Verify installed package versions match the listed fixed releases, run regression tests with TLS handshake fuzzers, and confirm no crash occurs on the previously triggering ClientHello pattern.

Typical attack path

1. Identify services exposing GnuTLS over the network
2. Craft and send a malicious TLS ClientHello targeting _gnutls_figure_common_ciphersuite()
3. Observe service crash or repeated connection failures
4. Repeat or automate to sustain denial of service

How to detect it

Monitor process crash logs, GnuTLS debug output, and TLS handshake error rates for sudden spikes; correlate with connection attempts from untrusted sources.

What your security team should do

• Apply the listed package upgrades immediately on all affected Alpaquita systems
• Prioritize internet-facing TLS endpoints first
• Enable GnuTLS logging at debug level temporarily to capture handshake anomalies
• Reassess EPSS trend weekly until the score stabilizes