CVE-2025-38166: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38166 is a Linux kernel vulnerability in the BPF and TLS (Transport Layer Security) sockmap implementation that can trigger a kernel panic (denial of service). The flaw was disclosed on July 3, 2025, and affects Linux kernel versions 4.20–6.1.141, 6.2–6.6.93, 6.7–6.12.33, and 6.13–6.15.2, as well as Debian Linux 11.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper state management (CWE-664) in tls_sw_sendmsg_locked() when a BPF program calls bpf_msg_push_data() during TX verdict processing, increasing the size of msg_pl->sg. If cork_bytes is set and sg.size is smaller than cork_bytes, the code attempts to roll back to non-zero-copy logic by reverting msg->msg_iter; however, because msg_pl->sg.size has already been increased, the revert calculation (iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size)) exceeds the actual iterator bounds, triggering a kernel BUG at lib/iov_iter.c:629. The fix eliminates the erroneous rollback path: when cork_bytes is set and a cork situation occurs, the code now proceeds directly to zero-copy logic and returns the copied byte count without error, consistent with the behavior of non-TLS TCP BPF sockets (Red Hat Bugzilla).

Successful exploitation causes a kernel panic, resulting in a complete system crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker with low-privileged local access who can load BPF programs and interact with TLS sockmap sockets can crash the affected host, potentially disrupting all services running on it (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. Exploitation requires local access with at least low privileges and the ability to load BPF programs (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.1.142 or later (for the 6.1 stable branch), 6.6.94 or later, 6.12.34 or later, or 6.15.3 or later. Vendor-specific patches have been issued by Red Hat (RHSA-2026:18134 for RHEL 10, RHSA-2026:18587 for RHEL 9), Debian (DSA-5973-1, DLA-4328-1), SUSE, and Ubuntu (USN-7769-1, USN-7769-2, USN-7789-1). As a workaround where patching is not immediately possible, restricting unprivileged BPF program loading (e.g., setting kernel.unprivileged_bpf_disabled=1) reduces the attack surface (Red Hat Bugzilla, Red Hat Advisory).