CVE-2025-38471
A critical bug in the Linux kernel’s TLS implementation could let an attacker trigger a use‑after‑free, potentially allowing arbitrary code execution. The flaw occurs when the kernel reads a socket and reuses an old packet buffer. It has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel versions 6.1 and 6.16 (and earlier 6.1 releases) are affected. Any system running these kernels without the patch is vulnerable.
Real-world impact
An attacker could exploit the use‑after‑free to corrupt memory and run arbitrary code on the affected system, compromising confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication, with no user interaction, and can lead to complete compromise of the system.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix (e.g., 6.16 or later).
- 02Reboot the system or restart affected services to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2025 · Jul 28, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/1f3a429c21e0e43e8b…patch
- git.kernel.org/stable/c/4ab26bce3969f8fd92…patch
- git.kernel.org/stable/c/730fed2ff5e2594957…patch
- git.kernel.org/stable/c/c76f6f437c46b23908…patch
- git.kernel.org/stable/c/cdb767915fc9a15d88…patch
- lists.debian.org/debian-lts-announce/2025/10…third party advisory
- cert-portal.siemens.com/productcert/html/ssa-082556…