Critical Vulnerability Resolved in Linux Kernel's NFS over TLS

What changed

A critical vulnerability, identified as CVE-2025-38566, has been addressed in the Linux kernel concerning the handling of server-side TLS alerts in NFS over TLS. The flaw was discovered in the function tls_alert_recv(), which improperly managed the reading of data from the message iterator's kvec.

The patch modifies the setup and usage of control messages by the sock_recvmsg() function, ensuring that the kTLS layer correctly processes TLS non-data record payloads.

Who is affected

This vulnerability impacts various users and organizations utilizing the Linux kernel for network file systems, particularly those relying on TLS for secure communications.

Affected groups include:

• Organizations using Linux-based servers with NFS over TLS.
• Developers maintaining applications that rely on the Linux kernel's networking stack.
• Enterprises that prioritize secure file transfers and data integrity.

What to do

It is crucial for system administrators and security teams to apply the latest patches provided by the Linux kernel maintainers to mitigate the risks associated with this vulnerability.

Regularly monitor security advisories from the Linux community and ensure that systems are updated promptly to protect against potential exploits.