---
id: CVE-2025-38608
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

  When sending plaintext data, we initially calculated the corresponding
  ciphertext length
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

  When sending plaintext data, we initially calculated the corresponding
  ciphertext length. However,…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-908
  - CWE-131
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.0, < 5.4.297'
  - 'linux_kernel >= 5.5, < 5.10.241'
  - 'linux_kernel >= 5.11, < 5.15.190'
  - 'linux_kernel >= 5.16, < 6.1.148'
  - 'linux_kernel >= 6.2, < 6.6.102'
  - 'linux_kernel >= 6.7, < 6.12.42'
  - 'linux_kernel >= 6.13, < 6.15.10'
  - 'linux_kernel >= 6.16, < 6.16.1'
  - debian_linux = 11.0
patched:
  - linux_kernel 6.16.1
published: '2025-08-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:47.043'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38608'
references:
  - url: 'https://git.kernel.org/stable/c/0e853c1464bcf61207f8b5c32d2ac5ee495e859d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/16aca8bb4ad0d8a13c8b6da4007f4e52d53035bb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/178f6a5c8cb3b6be1602de0964cd440243f493c9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1e480387d4b42776f8957fb148af9d75ce93b96d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6ba20ff3cdb96a908b9dc93cf247d0b087672e7c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/73fc5d04009d3969ff8e8574f0fd769f04124e59'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/849d24dc5aed45ebeb3490df429356739256ac40'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/90d6ef67440cec2a0aad71a0108c8f216437345c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee03766d79de0f61ea29ffb6ab1c7b196ea1b02e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38608.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-38608'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2389471'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-38608'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38608'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025081923-CVE-2025-38608-e829@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00415
epssPercentile: 0.35583
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:52:13.300263Z'
scores:
  nvd: 8.6
  vendor: 4.4
  cna: 8.6
ingestedAt: '2026-10-15T22:48:25.515Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

When sending plaintext data, we initially calculated the corresponding
ciphertext length. However, if we later reduced the plaintext data length
via socket policy, we failed to recalculate the ciphertext length.

This results in transmitting buffers containing uninitialized data during
ciphertext transmission.

This causes uninitialized bytes to be appended after a complete
"Application Data" packet, leading to errors on the receiving end when
parsing TLS record.

## Affected

- `linux_kernel >= 5.0, < 5.4.297`
- `linux_kernel >= 5.5, < 5.10.241`
- `linux_kernel >= 5.11, < 5.15.190`
- `linux_kernel >= 5.16, < 6.1.148`
- `linux_kernel >= 6.2, < 6.6.102`
- `linux_kernel >= 6.7, < 6.12.42`
- `linux_kernel >= 6.13, < 6.15.10`
- `linux_kernel >= 6.16, < 6.16.1`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.16.1`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38608.json)