Vulnerability · CVE-2025-38166

In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG a

Q: Which versions are affected?

Compare what you have installed with debian/debian linux 11.0; Linux Linux d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8 d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

No weakness class is stored. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Jul 3, 2025 · catalog updated Oct 15, 2026 · Linux Linux

Check if you run it

No confirmed exploitation is on record for CVE-2025-38166. EPSS is 0.20%. Act only if a listed version of Linux Linux is installed.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: High7.8
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.20%
Remediation: Version ranges on file
Affected products: cpe debian/debian linux · cpe linux/linux kernel · vendor Linux Linux d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8

In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.946031] ? iov_iter_revert+0x178/0x180 [ 2172.946267] ? do_error_trap+0x7d/0x110 [ 2172.946499] ? iov_iter_revert+0x178/0x180 [ 2172.946736] ? exc_invalid_op+0x50/0x70 [ 2172.946961] ? iov_iter_revert+0x178/0x180 [ 2172.947197] ? asm_exc_invalid_op+0x1a/0x20 [ 2172.947446] ? iov_iter_revert+0x178/0x180 [ 2172.947683] ? iov_iter_revert+0x5c/0x180 [ 2172.947913] tls_sw_sendmsg_locked.isra.0+0x794/0x840 [ 2172.948206] tls_sw_sendmsg+0x52/0x80 [ 2172.948420] ? inet_sendmsg+0x1f/0x70 [ 2172.948634] __sys_sendto+0x1cd/0x200 [ 2172.948848] ? find_held_lock+0x2b/0x80 [ 2172.949072] ? syscall_trace_enter+0x140/0x270 [ 2172.949330] ? __lock_release.isra.0+0x5e/0x170 [ 2172.949595] ? find_held_lock+0x2b/0x80 [ 2172.949817] ? syscall_trace_enter+0x140/0x270 [ 2172.950211] ? lockdep_hardirqs_on_prepare+0xda/0x190 [ 2172.950632] ? ktime_get_coarse_real_ts64+0xc2/0xd0 [ 2172.951036] __x64_sys_sendto+0x24/0x30 [ 2172.951382] do_syscall_64+0x90/0x170 ...... After calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase, e.g., when the BPF program executes bpf_msg_push_data(). If the BPF program sets cork_bytes and sg.size is smaller than cork_bytes, it will return -ENOSPC and attempt to roll back to the non-zero copy logic. However, during rollback, msg->msg_iter is reset, but since msg_pl->sg.size has been increased, subsequent executions will exceed the actual size of msg_iter. ''' iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size); ''' The changes in this commit are based on the following considerations: 1. When cork_bytes is set, rolling back to non-zero copy logic is

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe debian/debian linux11.0
cpe linux/linux kernelversion unspecified
vendor Linux Linux d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8

How to fix CVE-2025-38166

Recommended remediation
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-38166. EPSS is 0.20%. Act only if a listed version of Linux Linux is installed.

Which versions are affected?

Compare what you have installed with debian/debian linux 11.0; Linux Linux d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8 d3b18ad31f93d0b6bae105c679018a1ba7daa9ca <328cac3f9f8ae394748485e769a527518a9137c8. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Jul 3, 2025 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.
Oct 15, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.

Sources

CVE.orgVulnerability recordCVE-2025-38166
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2025-38166
30-day exploitation probability 0.2%
first.org
EUVDVulnerability recordEUVD-2025-19778
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299]
euvd.enisa.europa.eu
NIST NVDVulnerability recordCVE-2025-38166
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.94529
nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

18/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity12/15
Public exploit0/10
Internet exposure0/10
Product prevalence5/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
7.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS probability
0.20% · p9.02%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Linux

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.