CVE-2025-39946

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tls: make sure to abort the stream if headers are bogus

Normally we wait for the socket to buffer up the whole record

before we service it. If the socket has a tiny buffer, however,

we read out the data sooner, to prevent connection stalls.

Make sure that we abort the connection when we find out late

that the record is actually invalid. Retrying the parsing is

fine in itself but since we copy some more data each time

before we parse we can overflow the allocated skb space.

Constructing a scenario in which we're under pressure without

enough data in the socket to parse the length upfront is quite

hard. syzbot figured out a way to do this by serving us the header

in small OOB sends, and then filling in the recvbuf with a large

normal send.

Make sure that tls_rx_msg_size() aborts strp, if we reach

an invalid record there's really no way to recover.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References