Linux kernel BPF kTLS sockmap panic

CVE-2025-38166 is a Linux kernel flaw in the interaction between BPF sockmap message processing and kernel TLS transmit handling. The bug occurs after bpf_exec_tx_verdict() modifies the message scatter-gather state, such as when a BPF program invokes functionality equivalent to pushing additional data into the message buffer. If corking is enabled and the updated scatter-gather size is smaller than the configured cork threshold, the code returns an out-of-space condition and attempts to roll back from the non-zero-copy path. During that rollback, the message iterator is reset using a size calculation derived from the modified scatter-gather length rather than the original iterator bounds. This can cause the iterator revert logic to exceed the actual size of the underlying iterator state, triggering a kernel BUG in iterator handling and causing a panic. The fix avoids the invalid rollback path in corking scenarios and instead transitions directly to the zero-copy handling path, acknowledging that the correct iterator rollback length cannot be reconstructed once BPF has expanded the message layout.