CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

UBUNTU-CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

UBUNTU-CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

EUVD-2026-64548

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74611

CVE-2026-74611 affects the Linux kernel TLS 1.3 receive path. When optimistic zero-copy is enabled via TLS_RX_EXPECT_NO_PAD, tls_decrypt_sg() advances msg->msg_iter to map user pages. If the decrypted record is not unpadded application data (e.g., a TLS 1.3 control record), tls_decrypt_sw() re...

CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610

CVE-2026-74610 is a kernel NULL pointer dereference in the Linux kernel's TLS ULP (Upper Layer Protocol) implementation. The root cause is in tls_sw_sendmsg_locked(): when the copy path fills the plaintext sk_msg ring, the full_record flag is not set, leaving the record unpushed. A subsequent spl...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

EUVD-2026-64547

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243

Netty (io.netty:netty-handler) versions 4.2.0.Final through 4.2.16.Final and through 4.1.136.Final contain a TLS hostname verification bypass on the SslProvider.OPENSSL client path. When a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 2...

EUVD-2026-64271

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...