CVE-2026-80852

CVE-2026-80852 is an out-of-bounds write in the Linux kernel's TLS device offload path (net/tls/tls_device.c). The root cause is that tls_push_data() skips its fragment-count check on an early MSG_MORE break, allowing num_frags to exceed MAX_SKB_FRAGS (17) when splice(SPLICE_F_MORE) calls are iss...