CVE-2025-38571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38571", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.025Z", "datePublished": "2025-08-19T17:02:51.620Z", "dateUpdated": "2026-10-15T22:02:25.809Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:59.633Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix client side handling of tls alerts\n\nA security exploit was discovered in NFS over TLS in tls_alert_recv\ndue to its assumption that there is valid data in the msghdr's\niterator's kvec.\n\nInstead, this patch proposes the rework how control messages are\nsetup and used by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a kvec\nbacked control buffer and read in the control message such as a TLS\nalert. Scott found that a msg iterator can advance the kvec pointer\nas a part of the copy process thus we need to revert the iterator\nbefore calling into the tls_alert_recv."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the SUNRPC/NFS client's TCP-with-TLS receive path, driven entirely by records arriving from the remote RPC peer over the network. A malicious NFS server \u2014 or, with `xprtsec=tls` (anonymous TLS, `tls_client_hello_anon`), any on-path attacker impersonating it \u2014 triggers the bug purely by sending crafted RPC framing followed by a TLS alert record.\nAC:L - The attacker controls both halves of the trigger: an RPC fragment with a bogus calldir or unmatched XID forces the client into the `ITER_DISCARD` path, and an ordinary TLS alert record (even a close_notify) is then sent at will, yielding a deterministic NULL dereference with no race, no memory-layout guessing, and no reliance on victim state.\nPR:N - No credentials or privileges on the victim client are needed; the attacker acts as the TLS peer. With `xprtsec=tls` the peer is entirely unauthenticated (RFC 9289 opportunistic TLS), so even an unauthenticated MITM qualifies, and alerts are processed regardless of RPC-level authentication.\nUI:N - Exploitation needs no action from any user or administrator at attack time \u2014 the NFS-over-TLS mount is pre-existing, and the bug fires from the `xprtiod` workqueue receive path as soon as the attacker's records arrive.\nS:U - The faulting code, the corrupted read, and the resulting crash are all inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - On the bvec and past-the-end-kvec paths `tls_alert_recv()` reads two bytes through a type-confused or out-of-bounds pointer (a `struct page *` mistaken for `iov_base`, or an adjacent stack/heap word), leaking kernel memory into the `tls_alert_recv` tracepoint and into a fatal/non-fatal error oracle. The disclosure is real but strictly bounded to two bytes and is not returned to the attacker in bulk.\nI:N - `tls_alert_recv()` only reads through the bad pointer \u2014 there is no out-of-bounds write, no use-after-free, and no type confusion that yields a write primitive. The only effect is a bogus alert level selecting `-EACCES` versus `-EAGAIN` in the client's error handling.\nA:H - The `ITER_DISCARD` path dereferences a NULL kvec (and the exhausted-kvec path dereferences a garbage pointer read past the array), producing a kernel oops in the `xprtiod` kworker that kills the RPC receive worker and wedges all NFS I/O on that transport, or panics the machine outright where `panic_on_oops` is set."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtsock.c"], "versions": [{"version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95", "status": "affected", "versionType": "git"}, {"version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "c36b2fbd60e8f9c6f975522130998608880c93be", "status": "affected", "versionType": "git"}, {"version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "3ee397eaaca4fa04db21bb98c8f1d0c6cc525368", "status": "affected", "versionType": "git"}, {"version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "3feada5baf4dc96e151ff2ca54630e1d274e5458", "status": "affected", "versionType": "git"}, {"version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "cc5d59081fa26506d02de2127ab822f40d88bc5a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/xprtsock.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.102", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.42", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.10", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.102"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.15.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.16.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95"}, {"url": "https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93be"}, {"url": "https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368"}, {"url": "https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458"}, {"url": "https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5a"}], "title": "sunrpc: fix client side handling of tls alerts", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:48.078418Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:25.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:48.078418Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:49.471Z"}}], "cna": {"title": "sunrpc: fix client side handling of tls alerts", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the SUNRPC/NFS client's TCP-with-TLS receive path, driven entirely by records arriving from the remote RPC peer over the network. A malicious NFS server \u2014 or, with `xprtsec=tls` (anonymous TLS, `tls_client_hello_anon`), any on-path attacker impersonating it \u2014 triggers the bug purely by sending crafted RPC framing followed by a TLS alert record.\nAC:L - The attacker controls both halves of the trigger: an RPC fragment with a bogus calldir or unmatched XID forces the client into the `ITER_DISCARD` path, and an ordinary TLS alert record (even a close_notify) is then sent at will, yielding a deterministic NULL dereference with no race, no memory-layout guessing, and no reliance on victim state.\nPR:N - No credentials or privileges on the victim client are needed; the attacker acts as the TLS peer. With `xprtsec=tls` the peer is entirely unauthenticated (RFC 9289 opportunistic TLS), so even an unauthenticated MITM qualifies, and alerts are processed regardless of RPC-level authentication.\nUI:N - Exploitation needs no action from any user or administrator at attack time \u2014 the NFS-over-TLS mount is pre-existing, and the bug fires from the `xprtiod` workqueue receive path as soon as the attacker's records arrive.\nS:U - The faulting code, the corrupted read, and the resulting crash are all inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - On the bvec and past-the-end-kvec paths `tls_alert_recv()` reads two bytes through a type-confused or out-of-bounds pointer (a `struct page *` mistaken for `iov_base`, or an adjacent stack/heap word), leaking kernel memory into the `tls_alert_recv` tracepoint and into a fatal/non-fatal error oracle. The disclosure is real but strictly bounded to two bytes and is not returned to the attacker in bulk.\nI:N - `tls_alert_recv()` only reads through the bad pointer \u2014 there is no out-of-bounds write, no use-after-free, and no type confusion that yields a write primitive. The only effect is a bogus alert level selecting `-EACCES` versus `-EAGAIN` in the client's error handling.\nA:H - The `ITER_DISCARD` path dereferences a NULL kvec (and the exhausted-kvec path dereferences a garbage pointer read past the array), producing a kernel oops in the `xprtiod` kworker that kills the RPC receive worker and wedges all NFS I/O on that transport, or panics the machine outright where `panic_on_oops` is set."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95", "versionType": "git"}, {"status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "c36b2fbd60e8f9c6f975522130998608880c93be", "versionType": "git"}, {"status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "3ee397eaaca4fa04db21bb98c8f1d0c6cc525368", "versionType": "git"}, {"status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "3feada5baf4dc96e151ff2ca54630e1d274e5458", "versionType": "git"}, {"status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "lessThan": "cc5d59081fa26506d02de2127ab822f40d88bc5a", "versionType": "git"}], "programFiles": ["net/sunrpc/xprtsock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.102", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.42", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.10", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.1", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sunrpc/xprtsock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95"}, {"url": "https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93be"}, {"url": "https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368"}, {"url": "https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458"}, {"url": "https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix client side handling of tls alerts\n\nA security exploit was discovered in NFS over TLS in tls_alert_recv\ndue to its assumption that there is valid data in the msghdr's\niterator's kvec.\n\nInstead, this patch proposes the rework how control messages are\nsetup and used by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a kvec\nbacked control buffer and read in the control message such as a TLS\nalert. Scott found that a msg iterator can advance the kvec pointer\nas a part of the copy process thus we need to revert the iterator\nbefore calling into the tls_alert_recv."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.102", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.42", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.1", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:59.633Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38571", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:25.809Z", "dateReserved": "2025-04-16T04:51:24.025Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-19T17:02:51.620Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/xprtsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95", "status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "versionType": "git"}, {"lessThan": "c36b2fbd60e8f9c6f975522130998608880c93be", "status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "versionType": "git"}, {"lessThan": "3ee397eaaca4fa04db21bb98c8f1d0c6cc525368", "status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "versionType": "git"}, {"lessThan": "3feada5baf4dc96e151ff2ca54630e1d274e5458", "status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "versionType": "git"}, {"lessThan": "cc5d59081fa26506d02de2127ab822f40d88bc5a", "status": "affected", "version": "dea034b963c8901bdcc3d3880c04f0d75c95112f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/xprtsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.102", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.42", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.10", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDBF16D8-C01C-4F6B-ABE0-F7DED4C98BCB", "versionEndExcluding": "6.6.102", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA7AA5E6-4376-4A85-A021-6ACC5FF801C3", "versionEndExcluding": "6.12.42", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142", "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB", "versionEndExcluding": "6.16.1", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix client side handling of tls alerts\n\nA security exploit was discovered in NFS over TLS in tls_alert_recv\ndue to its assumption that there is valid data in the msghdr's\niterator's kvec.\n\nInstead, this patch proposes the rework how control messages are\nsetup and used by sock_recvmsg().\n\nIf no control message structure is setup, kTLS layer will read and\nprocess TLS data record types. As soon as it encounters a TLS control\nmessage, it would return an error. At that point, NFS can setup a kvec\nbacked control buffer and read in the control message such as a TLS\nalert. Scott found that a msg iterator can advance the kvec pointer\nas a part of the copy process thus we need to revert the iterator\nbefore calling into the tls_alert_recv."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sunrpc: arregla el manejo del lado del cliente de las alertas tls Se descubri\u00f3 un exploit de seguridad en NFS sobre TLS en tls_alert_recv debido a su suposici\u00f3n de que hay datos v\u00e1lidos en el kvec del iterador de msghdr. En cambio, este parche propone volver a trabajar en c\u00f3mo se configuran y utilizan los mensajes de control por sock_recvmsg(). Si no se configura ninguna estructura de mensaje de control, la capa kTLS leer\u00e1 y procesar\u00e1 los tipos de registros de datos TLS. Tan pronto como encuentre un mensaje de control TLS, devolver\u00e1 un error. En ese punto, NFS puede configurar un b\u00fafer de control respaldado por kvec y leer el mensaje de control como una alerta TLS. Scott encontr\u00f3 que un iterador msg puede avanzar el puntero kvec como parte del proceso de copia, por lo tanto, necesitamos revertir el iterador antes de llamar a tls_alert_recv."}], "id": "CVE-2025-38571", "lastModified": "2026-10-15T22:18:45.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38571", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:51:48.078418Z", "version": "2.0.3"}}]}, "published": "2025-08-19T17:15:33.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sunrpc: fix client side handling of tls alerts", "id": "2389480", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2389480"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38571", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38571\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38571\nhttps://lore.kernel.org/linux-cve-announce/2025081910-CVE-2025-38571-ba2a@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-08-21T12:31:35.767576+00:00", "updated": "2025-08-21T12:31:35.767645+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}