CVE-2026-64047

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring<br /> <br /> When an sk_msg scatterlist ring wraps (sg.end sg.start],<br /> MAX_SKB_FRAGS - msg_pl-&gt;sg.start + 1,<br /> msg_pl-&gt;sg.data);<br /> <br /> This places the chain pointer at<br /> <br /> sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =<br /> &amp;data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =<br /> data[start + (MAX_SKB_FRAGS - start + 1) - 1] =<br /> data[MAX_SKB_FRAGS]<br /> <br /> instead of the true last entry. This is likely due to a "race" of<br /> the commit under Fixes landing close to<br /> commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")<br /> <br /> Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested<br /> by Sabrina).