CVE-2025-40176
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In the Linux kernel TLS subsystem, if tls_strp_msg_hold fails for async decryption, it can lead to use-after-free (UAF) of the skb or writing to userspace memory after recv() returns.
Risk Assessment
An attacker could exploit UAF or memory write to cause data integrity issues or denial of service.
Recommendation
Apply the patch that waits for all pending async decryptions when skb clone allocation fails.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption requests.