kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock()

A flaw was found in the Linux kernel’s TLS implementation net/tls/tlsdevice.c. The function getnetdevforsock is invoked during setsockopt, which is not executed under RCU Read-Copy-Update protection. It previously used skdstgetsk-dev, which can lead to a use-after-free UAF if the sk’s destination...

ROS-20261006-73-0059

The vulnerability of the net/tls/tlssw.c component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/tls: The use-after-free issue in the -EBUSY error handling path of tlsdoencryption has been fixed. The -EBUSY handling in tlsdoencryption, introduced with commit 859054147318 “net: tls: handle backlogging of crypto requests”,...

CVE-2025-39682

CVE-2025-39682 — Linux kTLS ゼロ長 rxlist レコード UAF トラッキングサイト CVE-2025-39682 パッチステータストラッカーのソース: Linux カーネルの kTLS 受信パス net/tls における use-after-free に対して、どのディストリビューションが修正を出荷済みかを記録するシングルページサイト。 事実が存在する場所 バグに関するすべて — CVE ID、影響を受けるバージョンと修正済みバージョン、アップストリームの修正コミット、発見および開示のクレジット、現在のディストリビューションごとのパッチステータス —...

Exploit for Improper Check for Unusual or Exceptional Conditions in Linux Linux_Kernel

CVE-2025-39682 — Linux kTLS zero-length rxlist record use-aft...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/tls: fixed a kernel panic that occurred when allocpage failed. We cannot set fraglist to a NULL pointer when allocpage fails. This setting will be used in tlsstrpcheckqueueok when tlsstrpreadsock is called next time. This ...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: TLS – Avoid hanging tasks when using txlock. The syzbot reported a situation where tasks were hung. Eric explains that the adversarial receiver may keep RWIN at 0 for a long time, so we cannot guarantee progress. Thread...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053313 advisory. In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tlserrabort calls sk-skerr appears to expect a positive value, a...

SUSE CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

AZL-99525 CVE-2026-80904 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904 net/tls: Fail tls_sw_splice_read() after a failed async decrypt

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

EUVD-2026-71663

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904

CVE-2026-80904 is a Linux kernel vulnerability in the net/tls (TLS offload) subsystem. When an asynchronous TLS decryption fails, tls_sw_recvmsg() and tls_sw_read_sock() correctly check async_wait.err and abort the read, but tls_sw_splice_read() performs no such check. As a result, a splice opera...

CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

PT-2026-91788

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls sw splice read after a failed async decrypt When an async decrypt fails, tls decrypt done records the error in ctx-async wait.err and calls tls err abort, which stores it in sk err. tls sw recvmsg and tls sw rea...

CVE-2026-80904: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

Linux Distros Unpatched Vulnerability : CVE-2026-80904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls...

The vulnerability in the net/tls/tls_sw.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the net/tls/tlssw.c component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/tls: Empty data records are consumed in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly allows these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption, suc...