CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tls: rx: restore msg_iter before TLS 1.3 optimistic retry<br /> <br /> tls_decrypt_sg() advances msg-&gt;msg_iter when it maps user pages for<br /> the optimistic TLS 1.3 zero-copy path. If the decrypted record turns<br /> out not to be unpadded application data, tls_decrypt_sw() retries into<br /> a kernel skb, but leaves the iterator advanced.<br /> <br /> The subsequent copy from the skb then writes decrypted bytes again at<br /> a later point in the caller iovecs while recvmsg() reports only the<br /> post-retry length. A TLS peer can trigger this after the receiver<br /> enables TLS_RX_EXPECT_NO_PAD.<br /> <br /> Revert the iterator by the number of bytes consumed by the optimistic<br /> mapping before retrying without zero-copy.<br /> <br /> Add a selftest which sends a TLS 1.3 control record with<br /> TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not<br /> overwrite later iovecs beyond the returned length.