{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39946","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.148Z","datePublished":"2025-10-04T07:31:07.871Z","dateUpdated":"2026-08-05T12:06:21.386Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:06:21.386Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: make sure to abort the stream if headers are bogus\n\nNormally we wait for the socket to buffer up the whole record\nbefore we service it. If the socket has a tiny buffer, however,\nwe read out the data sooner, to prevent connection stalls.\nMake sure that we abort the connection when we find out late\nthat the record is actually invalid. Retrying the parsing is\nfine in itself but since we copy some more data each time\nbefore we parse we can overflow the allocated skb space.\n\nConstructing a scenario in which we're under pressure without\nenough data in the socket to parse the length upfront is quite\nhard. syzbot figured out a way to do this by serving us the header\nin small OOB sends, and then filling in the recvbuf with a large\nnormal send.\n\nMake sure that tls_rx_msg_size() aborts strp, if we reach\nan invalid record there's really no way to recover."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"Remote TLS peer can overflow kernel skb by sending crafted TLS record headers via small OOB sends followed by large normal send. The kTLS receive path in tls_strp_copyin_frag() writes past allocated skb fragments. Network-reachable, no authentication required."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls.h","net/tls/tls_strp.c","net/tls/tls_sw.c"],"versions":[{"version":"84c61fe1a75b4255df1e1e7c054c9e6d048da417","lessThan":"b36462146d86b1f22e594fe4dae611dffacfb203","status":"affected","versionType":"git"},{"version":"84c61fe1a75b4255df1e1e7c054c9e6d048da417","lessThan":"4cefe5be73886f383639fe0850bb72d5b568a7b9","status":"affected","versionType":"git"},{"version":"84c61fe1a75b4255df1e1e7c054c9e6d048da417","lessThan":"208640e6225cc929a05adbf79d1df558add3e231","status":"affected","versionType":"git"},{"version":"84c61fe1a75b4255df1e1e7c054c9e6d048da417","lessThan":"61ca2da5fb8f433ce8bbd1657c84a86272133e6b","status":"affected","versionType":"git"},{"version":"84c61fe1a75b4255df1e1e7c054c9e6d048da417","lessThan":"0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls.h","net/tls/tls_strp.c","net/tls/tls_sw.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.1.154","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.108","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.49","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.9","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.108"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.49"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.16.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b36462146d86b1f22e594fe4dae611dffacfb203"},{"url":"https://git.kernel.org/stable/c/4cefe5be73886f383639fe0850bb72d5b568a7b9"},{"url":"https://git.kernel.org/stable/c/208640e6225cc929a05adbf79d1df558add3e231"},{"url":"https://git.kernel.org/stable/c/61ca2da5fb8f433ce8bbd1657c84a86272133e6b"},{"url":"https://git.kernel.org/stable/c/0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d"}],"title":"tls: make sure to abort the stream if headers are bogus","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-16T16:09:56.692660Z","id":"CVE-2025-39946","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-16T16:11:14.264Z"}}]}}