In the Linux kernel, the following vulnerability has been resolved:
sunrpc: fix client side handling of tls alerts
A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec.
Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg().
If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade python3-perfUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-64kUpgrade kernel-debug-uki-virtUpgrade kernel-modulesUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-rt-debug-coreUpgrade rtlaUpgrade kernel-64k-develUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-docUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade kernel-uki-virtUpgrade rvUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virt-addonsUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-debug-coreUpgrade kernel-cross-headersUpgrade kernelUpgrade libperfUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-64k-debugUpgrade kernel-headers | Oct 23, 2025 | Oct 20, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel-livepatch-6.12.46-66.121Upgrade bpftool6.12-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12-libbpf-develUpgrade kernel6.12Upgrade kernel6.12-toolsUpgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-tools-develUpgrade python3-perf6.12Upgrade kernel6.12-libbpfUpgrade perf6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-libbpf-static | Sep 30, 2025 | Aug 19, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Sep 24, 2025 | Aug 19, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Oct 21, 2025 | Aug 19, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-uki-virtUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade rvUpgrade kernel-zfcpdump-modulesUpgrade libperfUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdumpUpgrade perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-modules-extraUpgrade perfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-develUpgrade rtlaUpgrade kernelUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-modules-core | Feb 5, 2026 | Oct 26, 2025 |
| Suse | — | Upgrade dtb-nvidiaUpgrade gfs2-kmp-azureUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-armUpgrade kernel-obs-buildUpgrade kernel-default-livepatch-develUpgrade kernel-source-rtUpgrade kernel-defaultUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade dtb-caviumUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-azureUpgrade dtb-mediatekUpgrade dtb-qcomUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt-extraUpgrade kernel-debug-vdsoUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade dtb-alteraUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade ocfs2-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-rt-livepatch-develUpgrade dtb-exynosUpgrade kernel-default-optionalUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-syms-azureUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-optionalUpgrade dtb-marvellUpgrade dtb-appleUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-devel | Dec 5, 2025 | Oct 23, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-fips-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-aws-6.14Upgrade linux-image-oracle-6.8Upgrade linux-image-xilinxUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-realtimeUpgrade linux-image-xilinx-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-gke-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-aws-64k-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-virtual-6.14Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-gcpUpgrade linux-image-aws-64k-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-realtime-6.14Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-generic-6.14Upgrade linux-image-fips-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gke-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-6.14Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-azure-6.14Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-generic-64kUpgrade linux-image-azure-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-virtualUpgrade linux-image-oracle-6.14Upgrade linux-image-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-6.14Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-intel-iotgUpgrade linux-image-ibm-classicUpgrade linux-image-gkeUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-genericUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-fipsUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1043-oracle | Nov 25, 2025 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub