Linux kernel (net/tls): Sendfile() on a kTLS socket whose plaintext and ciphertext buffers are both empty drives the

Impact

Sendfile() on a kTLS socket whose plaintext and ciphertext buffers are both empty drives the splice EOF path into the BPF-only 'split record' branch and then into record merging, which assumes a populated buffer - a NULL dereference and kernel oops in the transmit path.

Who can reach it

Local and unprivileged: any process with a kTLS socket calling sendfile()/splice() after a send that bailed out and trimmed both buffers. Every tenant container reaches this with ordinary syscalls - no device node, no capability, no cooperating peer. On kernels with panic_on_oops this is a tenant-triggerable node kill.

What to do

Boot a kernel carrying the linked stable commits. Interim: none at the tenant boundary; review panic_on_oops policy, since it converts a task oops into a full-node outage here.

References