Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s interaction between BPF sockmaps and kernel TLS can trigger a kernel panic during message handling. Exploitation requires local access and a specific feature combination, limiting broad exposure. Successful triggering could disrupt affected systems; the supplied CVSS assessment also indicates possible confidentiality and integrity impact, although the technical description primarily demonstrates a crash.
Executive priority
Treat this as a high-priority kernel maintenance issue where the affected feature combination is present, particularly on shared or locally accessible systems. Broad emergency action is not supported by the evidence because exploitation is local, configuration-dependent, and not documented as active. Establish exposure quickly, then patch confirmed systems through normal expedited kernel update procedures.
Technical view
After a BPF transmit verdict changes a scatter-gather message, corking can produce an ENOSPC rollback. The rollback resets the message iterator but uses the enlarged scatter-gather size, allowing iov_iter_revert to exceed the iterator’s actual size and reach a kernel BUG. The resolution changes handling so corked traffic proceeds through the appropriate zero-copy path instead of the unsafe rollback.
Likely exposure
Exposure is most likely on Linux systems using BPF sockmaps together with kernel TLS and permitting a low-privileged local actor to reach the vulnerable path. The record identifies Linux versions including 4.20, 6.1.142, 6.6.94, 6.12.34, 6.15.3, and 6.16, but distribution backports require vendor-specific verification.
Exploitation context
The supplied record has CVSS 7.8 with local access, low complexity, low privileges, and no user interaction. It is not listed as KEV, and no supplied source establishes active exploitation. The described reproducible outcome is a kernel panic; the record’s confidentiality and integrity ratings are not further demonstrated in the supplied technical narrative.
Researcher notes
The unsafe state arises because BPF message mutation increases msg_pl->sg.size while the underlying iterator does not represent all pushed data. Corking then makes an exact iterator rollback impractical. The source bundle lists multiple stable commits, suggesting branch-specific fixes. Exact vulnerable ranges and distro package mappings remain incomplete and should be resolved through upstream and distribution advisories.
Mitigation direction
- Apply a vendor-supported kernel update containing the relevant stable fix or backport.
- Check distribution advisories because package versions may not match upstream kernel version numbers.
- Prioritize systems that use both BPF sockmaps and kernel TLS.
- If patching is delayed, obtain supported temporary mitigation guidance from the kernel or distribution vendor.
Validation and detection
- Inventory deployed kernel builds and compare them with vendor-fixed package information.
- Confirm whether BPF sockmaps and kernel TLS are used on potentially affected hosts.
- Verify the installed kernel includes the applicable referenced stable commit or vendor backport.
- Review kernel logs for BUG events involving iov_iter_revert or tls_sw_sendmsg.
- Retest affected workloads after updating and monitor for recurring kernel panics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38166 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/328cac3f9f8ae394748485e769a527518a9137c8CVE reference, Linux
- https://git.kernel.org/stable/c/2e36a81d388ec9c3f78b6223f7eda2088cd40adbCVE reference, Linux
- https://git.kernel.org/stable/c/57fbbe29e86042bbaa31c1a30d2afa16c427e3f7CVE reference, Linux
- https://git.kernel.org/stable/c/603943f022a7fe5cc83ca7005faf34798fb7853fCVE reference, Linux
- https://git.kernel.org/stable/c/54a3ecaeeeae8176da8badbd7d72af1017032c39CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.