{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2025-38166 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38166 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38166 and fix it if it is affected.\n\nWhat it is: CVE-2025-38166 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38166 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38166/ (Markdown: https://insights.sbomify.com/CVE-2025-38166/index.md)","id":"CVE-2025-38166","markdown":"https://insights.sbomify.com/CVE-2025-38166/index.md","name":"CVE-2025-38166","record":{"aliases":["AZL-64637","AZL-72760","BELL-CVE-2025-38166","DEBIAN-CVE-2025-38166","GHSA-4grq-496q-c892","ROOT-OS-DEBIAN-11-CVE-2025-38166","ROOT-OS-DEBIAN-12-CVE-2025-38166","ROOT-OS-UBUNTU-2204-CVE-2025-38166","ROOT-OS-UBUNTU-2404-CVE-2025-38166","UBUNTU-CVE-2025-38166"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger a kernel panic in the Linux kernel's BPF sockmap implementation by manipulating message sizes, causing a system crash.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix ktls panic with sockmap\n\n[ 2172.936997] ------------[ cut here ]------------\n[ 2172.936999] kernel BUG at lib/iov_iter.c:629!\n......\n[ 2172.944996] PKRU: 55555554\n[ 2172.945155] Call Trace:\n[ 2172.945299]  \u003cTASK\u003e\n[ 2172.945428]  ? die+0x36/0x90\n[ 2172.945601]  ? do_trap+0xdd/0x100\n[ 2172.945795]  ? iov_iter_revert+0x178/0x180\n[ 2172.946031]  ? iov_iter_revert+0x178/0x180\n[ 2172.946267]  ? do_error_trap+0x7d/0x110\n[ 2172.946499]  ? iov_iter_revert+0x178/0x180\n[ 2172.946736]  ? exc_invalid_op+0x50/0x70\n[ 2172.946961]  ? iov_iter_revert+0x178/0x180\n[ 2172.947197]  ? asm_exc_invalid_op+0x1a/0x20\n[ 2172.947446]  ? iov_iter_revert+0x178/0x180\n[ 2172.947683]  ? iov_iter_revert+0x5c/0x180\n[ 2172.947913]  tls_sw_sendmsg_locked.isra.0+0x794/0x840\n[ 2172.948206]  tls_sw_sendmsg+0x52/0x80\n[ 2172.948420]  ? inet_sendmsg+0x1f/0x70\n[ 2172.948634]  __sys_sendto+0x1cd/0x200\n[ 2172.948848]  ? find_held_lock+0x2b/0x80\n[ 2172.949072]  ? syscall_trace_enter+0x140/0x270\n[ 2172.949330]  ? __lock_release.isra.0+0x5e/0x170\n[ 2172.949595]  ? find_held_lock+0x2b/0x80\n[ 2172.949817]  ? syscall_trace_enter+0x140/0x270\n[ 2172.950211]  ? lockdep_hardirqs_on_prepare+0xda/0x190\n[ 2172.950632]  ? ktime_get_coarse_real_ts64+0xc2/0xd0\n[ 2172.951036]  __x64_sys_sendto+0x24/0x30\n[ 2172.951382]  do_syscall_64+0x90/0x170\n......\n\nAfter calling bpf_exec_tx_verdict(), the size of msg_pl-\u003esg may increase,\ne.g., when the BPF program executes bpf_msg_push_data().\n\nIf the BPF program sets cork_bytes and sg.size is smaller than cork_bytes,\nit will return -ENOSPC and attempt to roll back to the non-zero copy\nlogic. However, during rollback, msg-\u003emsg_iter is reset, but since\nmsg_pl-\u003esg.size has been increased, subsequent executions will exceed the\nactual size of msg_iter.\n'''\niov_iter_revert(\u0026msg-\u003emsg_iter, msg_pl-\u003esg.size - orig_size);\n'''\n\nThe changes in this commit are based on the following considerations:\n\n1. When cork_bytes is set, rolling back to non-zero copy logic is\npointless and can directly go to zero-copy logic.\n\n2. We can not calculate the correct number of bytes to revert msg_iter.\n\nAssume the original data is \"abcdefgh\" (8 bytes), and after 3 pushes\nby the BPF program, it becomes 11-byte data: \"abc?de?fgh?\".\nThen, we set cork_bytes to 6, which means the first 6 bytes have been\nprocessed, and the remaining 5 bytes \"?fgh?\" will be cached until the\nlength meets the cork_bytes requirement.\n\nHowever, some data in \"?fgh?\" is not within 'sg-\u003emsg_iter'\n(but in msg_pl instead), especially the data \"?\" we pushed.\n\nSo it doesn't seem as simple as just reverting through an offset of\nmsg_iter.\n\n3. For non-TLS sockets in tcp_bpf_sendmsg, when a \"cork\" situation occurs,\nthe user-space send() doesn't return an error, and the returned length is\nthe same as the input length parameter, even if some data is cached.\n\nAdditionally, I saw that the current non-zero-copy logic for handling\ncorking is written as:\n'''\nline 1177\nelse if (ret != -EAGAIN) {\n\tif (ret == -ENOSPC)\n\t\tret = 0;\n\tgoto send_end;\n'''\n\nSo it's ok to just return 'copied' without error when a \"cork\" situation\noccurs.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: fix ktls panic with sockmap","id":"CVE-2025-38166","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"denial_of_service","year":"2025"},"n_packages":0,"n_references":5,"next":{"headline":"fs/ntfs3: handle hdr_first_de() return value","id":"CVE-2025-38167"},"packages":[],"prev":{"headline":"bpf, sockmap: Fix panic when calling skb_linearize","id":"CVE-2025-38165"},"products":["Linux"],"published":"2025-07-03","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel panic in the Linux kernel's BPF sockmap implementation by manipulating message sizes, causing a system crash.","url":"https://insights.sbomify.com/CVE-2025-38166/"}