CVE-2025-38471

Vulnerability

The Linux kernel's TLS subsystem contains a use-after-free vulnerability in tls_strp_check_rcv. When the TCP stack aggressively compacts skbs (a change recently introduced in net-next), the TLS receive path may hold a stale reference to a freed skb while checking decrypt state and geometry. This triggers a KASAN slab-use-after-free read access during tls_strp_check_rcv and subsequent receive operations [1].

Exploitation

An attacker must be able to send TLS traffic to the target system, triggering the race condition between skb compaction in TCP and the TLS record parsing. No special privileges are required beyond network access to send data to an TLS socket. The bug manifests when the socket is read via tls_sw_recvmsg, which calls tls_rx_rec_wait and then tls_strp_check_rcv [1].

Impact

A successful exploit could allow an unauthenticated remote attacker to cause a kernel crash (denial of service) or potentially achieve arbitrary code execution in kernel context, given the use-after-free condition permits out-of-bounds access [1].

Mitigation

The fix ensures the socket buffer queue is always refreshed before operating on any skb, so that a stale reference is never used. Patches have been incorporated into the stable kernel tree [2][3][4]. Siemens has also identified affected products (e.g., SIMATIC S7-1500 CPU family) and recommends applying the provided updates [1].