CVE-2026-74610

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tls: don&amp;#39;t leave a full plaintext sk_msg ring unpushed<br /> <br /> When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills<br /> the plaintext sk_msg ring, it does not set full_record, so the record is<br /> left full and unpushed. A later splice() then adds to an already full<br /> ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps<br /> onto sg.start and the ring appears empty. Fragments added after that<br /> overwrite live entries, and sg.size no longer matches what is reachable<br /> between sg.start and sg.end, so pushing the record runs the scatterwalk off<br /> the end of the scatterlist.<br /> <br /> An unprivileged user can trigger this on a loopback TCP socket with the<br /> "tls" ULP attached:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000008<br /> RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0<br /> Call Trace:<br /> skcipher_walk_next+0x1d1/0x2c0<br /> gcm_encrypt_aesni_avx+0x1e9/0x220<br /> bpf_exec_tx_verdict+0x3bb/0x860<br /> tls_sw_sendmsg+0xa1a/0xca0<br /> __sys_sendto+0x1da/0x1f0<br /> <br /> Set full_record in the copy path when the ring becomes full, and push a<br /> record that is already full on entry to the sendmsg loop.