Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back to

Impact

When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back to the head is planted one entry short of the true last slot. The crypto layer is then handed a scatter list that describes the wrong memory, so a TLS record is encrypted from - and written into - buffers the socket does not own. That is attacker-influenceable memory corruption plus plaintext confusion on the encrypted control and storage plane: bytes from an unrelated buffer can end up inside a record on the wire.

Who can reach it

Any local process that owns a socket and enables kTLS via setsockopt(TLS_TX), which every tenant container can do without privilege. The bug needs the send ring to wrap, which happens naturally with sustained scatter-gather sends; a tenant can arrange it deliberately with a chosen write pattern. The CNA scores it network-reachable because a peer's flow-control behaviour shapes when the ring wraps. No device node required.

What to do

Boot a kernel carrying the fix commits below - the version field in the record (5.5) marks where the flaw was introduced, not a fixed release, so match by commit against your vendor kernel. Interim control: blacklist the tls ULP so tenant workloads use userspace TLS until nodes are rebooted.

References

Related entries

• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel (net/tls): A non-DATA record already copied out of the pending list could be merged with a second recordCVE-2024-58239 · Linux kernel (net/tls)High
• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• Linux kernel (net/tls): KTLS never supported disconnect, but nothing stopped it. A connect(AF_UNSPEC) on a TLS socketCVE-2025-37756 · Linux kernel (net/tls)High
• Linux kernel (net/tls): A BPF verdict that grows the scatterlist (bpf_msg_push_data) combined with a cork_bytes settingCVE-2025-38166 · Linux kernel (net/tls)High
• Linux kernel (net/tls): KTLS assumes it owns the TCP receive queue. When another reader drains bytes first, the oldCVE-2025-38616 · Linux kernel (net/tls)High