CVE-2025-38566: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38566 is a vulnerability discovered in the Linux kernel affecting the NFS over TLS implementation. The issue was identified by Scott Mayhew and involves improper handling of server-side TLS alerts in the tlsalertrecv() function (Debian Security).

The vulnerability stems from an incorrect assumption in the tlsalertrecv() function that it can read data from the msg iterator's kvec. The kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS alert or TLS cipher change) and the rest of the payload (TLS alert's level/description) which goes into the msg payload buffer (Debian Security).

The vulnerability affects various Linux distributions and kernel versions, with particular impact on systems using NFS over TLS. Fixed versions have been released for multiple distributions including Ubuntu 24.04 LTS (noble) and Debian (Debian Security).

The issue has been patched in several Linux kernel versions. The fix involves reworking how control messages are setup and used by sock_recvmsg(). The patch ensures that if no control message structure is setup, the kTLS layer will read and process TLS data record types, and return an error upon encountering a TLS control message (Debian Security).