CVE-2025-38566
A critical flaw in the Linux kernel’s NFS over TLS implementation allows attackers to trigger a crash or denial of service by sending malformed TLS alerts. The vulnerability arises from improper handling of control messages in the kTLS layer. It has been fixed in kernel 6.17.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.17 and earlier versions, especially systems running NFS over TLS. Typical users include system administrators managing Linux servers that expose NFS services.
Real-world impact
An attacker could cause a denial of service on a vulnerable system by sending crafted TLS alerts to an NFS server, potentially crashing the kernel or disrupting services.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact (complete confidentiality, integrity, and availability loss) combined with its low attack complexity and lack of required privileges or user interaction.
What to do about it
- 011. Update the Linux kernel to version 6.17 or later.
- 022. Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Aug 19, 2025 · Aug 19, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6h agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 2h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.