Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can cause systems using kernel TLS with a specific BPF socket policy operation to send unintended, uninitialized bytes. This may expose residual data and cause receiving applications to reject malformed TLS records. Exposure depends on whether the affected kTLS and BPF features are used together.
Executive priority
Treat as a high-priority, targeted kernel update rather than an indiscriminate emergency. Rapidly identify systems using kTLS with BPF socket policy, patch those first, and follow normal accelerated maintenance for remaining affected kernels. Escalate if sensitive workloads expose the vulnerable path.
Technical view
When bpf_msg_pop_data() shortens plaintext governed by socket policy, kTLS previously retained the original ciphertext-length calculation. Transmission could therefore include uninitialized bytes after a complete TLS Application Data record, creating potential confidentiality loss, limited corruption, and receiver-side parsing failures.
Likely exposure
Likely exposure is limited to Linux systems using kTLS together with BPF socket policy that invokes bpf_msg_pop_data(). The bundle lists multiple affected kernel branches, but does not provide reliable distribution-specific package ranges. Systems not using this feature combination are unlikely to reach the vulnerable path.
Exploitation context
The supplied record has a CVSS 3.1 score of 8.6 and a network attack vector, but it is not listed in KEV. No supplied source reports active exploitation or a public exploit. Practical reachability and attacker control over the relevant BPF policy path remain unclear from the evidence.
Researcher notes
The defect is a stale length calculation after plaintext reduction, not a conventional TLS cryptographic break. Uninitialized trailing bytes create an information-disclosure concern and can disrupt TLS parsing. The bundle supplies multiple stable-branch fixes but insufficient information to establish exploitability, attacker prerequisites, or precise distribution package boundaries.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable upstream stable fix.
- Check the Linux distribution's advisory for exact fixed package versions and reboot requirements.
- Prioritize systems confirmed to use both kTLS and relevant BPF socket policies.
- If updates are delayed, seek vendor guidance for safely avoiding the affected feature combination.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Determine whether kTLS and BPF socket policies using bpf_msg_pop_data() are deployed.
- Compare installed kernels with vendor advisories or the applicable upstream stable fix.
- Confirm updated systems booted into the fixed kernel.
- Review TLS receiver logs for unexplained record-parsing failures or malformed trailing data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38608 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L3.94.7LinuxVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6ba20ff3cdb96a908b9dc93cf247d0b087672e7cCVE reference, Linux
- https://git.kernel.org/stable/c/849d24dc5aed45ebeb3490df429356739256ac40CVE reference, Linux
- https://git.kernel.org/stable/c/73fc5d04009d3969ff8e8574f0fd769f04124e59CVE reference, Linux
- https://git.kernel.org/stable/c/16aca8bb4ad0d8a13c8b6da4007f4e52d53035bbCVE reference, Linux
- https://git.kernel.org/stable/c/0e853c1464bcf61207f8b5c32d2ac5ee495e859dCVE reference, Linux
- https://git.kernel.org/stable/c/ee03766d79de0f61ea29ffb6ab1c7b196ea1b02eCVE reference, Linux
- https://git.kernel.org/stable/c/90d6ef67440cec2a0aad71a0108c8f216437345cCVE reference, Linux
- https://git.kernel.org/stable/c/1e480387d4b42776f8957fb148af9d75ce93b96dCVE reference, Linux
- https://git.kernel.org/stable/c/178f6a5c8cb3b6be1602de0964cd440243f493c9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.