Security readout for executives and security teams
Plain-English summary
A Linux kernel TLS receive-path flaw can read memory after it has been freed when TCP reorganizes queued network data. This can cause kernel instability and may affect confidentiality or integrity, but the supplied evidence does not demonstrate code execution or real-world attacks.
Executive priority
Treat remediation as urgent where affected kernels use kernel TLS, especially on exposed or critical systems. Validate actual configuration before assuming broad exposure. The critical score supports rapid patch governance, while the absence of documented exploitation reduces justification for emergency disruption without confirming applicability.
Technical view
TCP skb compaction can leave Linux kernel TLS parsing with a stale skb reference. tls_strp_check_rcv may then perform a slab use-after-free read while comparing queued records’ decryption state and geometry. The correction refreshes the receive queue before continuing.
Likely exposure
Exposure is limited to systems running a listed affected Linux release where the kernel TLS receive path is available and exercised. The bundle identifies 6.1, 6.1.147, 6.6.100, 6.12.40, 6.15.8, and 6.16, but does not clearly define complete affected ranges.
Exploitation context
The supplied record assigns CVSS 9.8, but provides only a KASAN-detected use-after-free read. It is not in KEV, and the bundle contains no evidence of active exploitation, a public proof of concept, or demonstrated remote code execution.
Researcher notes
The demonstrated condition is a stale skb dereference in tls_strp_check_rcv after aggressive TCP skb compaction. Available evidence establishes a slab use-after-free read, not reliable control of execution. Researchers should distinguish the CVSS impact assumptions from demonstrated outcomes and use the branch-specific stable commits when checking backports.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable upstream stable correction.
- Review Debian, Siemens, or other relevant vendor advisories for product-specific fixed versions.
- Prioritize internet-facing or high-availability systems that actively use kernel TLS.
- If updates must wait, consult vendor guidance for supported temporary risk-reduction measures.
Validation and detection
- Inventory running kernel versions and compare them with applicable vendor advisories.
- Confirm the installed kernel includes the relevant stable correction for its release branch.
- Determine whether kernel TLS receive functionality is enabled and used on each system.
- After updating, verify the fixed kernel is running rather than merely installed.
- Monitor kernel diagnostics for TLS-related KASAN reports, crashes, or abnormal receive-path behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38471 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/730fed2ff5e259495712518e18d9f521f61972bbCVE reference, Linux
- https://git.kernel.org/stable/c/1f3a429c21e0e43e8b8c55d30701e91411a4df02CVE reference, Linux
- https://git.kernel.org/stable/c/cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8CVE reference, Linux
- https://git.kernel.org/stable/c/c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6CVE reference, Linux
- https://git.kernel.org/stable/c/4ab26bce3969f8fd925fe6f6f551e4d1a508c68bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.