Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next… (CVE-2025-38471)
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len").
AI Analysis
Technical Summary
The vulnerability CVE-2025-38471 affects the kernel live patch module used by the kpatch utility on Red Hat Enterprise Linux 9.4 with kernel version 5.14.0-427.13.1.el9_4. The issue is in the kernel TLS code where the queue was not always refreshed when reading from a socket, potentially leading to use-after-free conditions (CWE-416). Red Hat has released multiple kpatch-patch updates to address this issue. The update requires a reboot to apply the fix. No CVSS score is provided in the advisory, but Red Hat rates the update as important.
Potential Impact
The vulnerability affects the kernel's TLS socket reading functionality, which could lead to use-after-free conditions. This may impact system stability or security when handling TLS traffic at the kernel level. The advisory does not report known exploits in the wild. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical.
Mitigation Recommendations
Red Hat has released updated kpatch-patch packages for kernel 5.14.0-427.13.1.el9_4 to fix this vulnerability. Users should apply the provided security updates and reboot their systems for the patch to take effect. Refer to the Red Hat advisory RHSA-2025:14811 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next… (CVE-2025-38471)
Description
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len").
CVSS v3.1
Score 9.8critical
Affected software
pkg:rpm/redhat/kpatch-patch-5_14_0-427_13_1Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-38471 affects the kernel live patch module used by the kpatch utility on Red Hat Enterprise Linux 9.4 with kernel version 5.14.0-427.13.1.el9_4. The issue is in the kernel TLS code where the queue was not always refreshed when reading from a socket, potentially leading to use-after-free conditions (CWE-416). Red Hat has released multiple kpatch-patch updates to address this issue. The update requires a reboot to apply the fix. No CVSS score is provided in the advisory, but Red Hat rates the update as important.
Potential Impact
The vulnerability affects the kernel's TLS socket reading functionality, which could lead to use-after-free conditions. This may impact system stability or security when handling TLS traffic at the kernel level. The advisory does not report known exploits in the wild. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical.
Mitigation Recommendations
Red Hat has released updated kpatch-patch packages for kernel 5.14.0-427.13.1.el9_4 to fix this vulnerability. Users should apply the provided security updates and reboot their systems for the patch to take effect. Refer to the Red Hat advisory RHSA-2025:14811 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:14811
- Cve Count
- 1
Threat ID: 6a419cb627e9c79719abd403
Added to database: 06/28/2026, 22:14:14 UTC
Last enriched: 06/28/2026, 22:30:57 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.