Linux kernel (net/tls): When a decrypt goes to the crypto backlog and a sibling decrypt fails, the error path releases

Impact

When a decrypt goes to the crypto backlog and a sibling decrypt fails, the error path releases pages that the async callback has already freed. That is a double free of record pages in the kTLS receive path, reachable from the network.

Who can reach it

Remote records plus a saturated crypto queue, which a co-tenant running heavy encrypted I/O on the same node produces. Any kTLS RX socket qualifies; no local privilege or device node. Requires a backlog-capable async AEAD (cryptd/AES-NI).

What to do

Update to 6.6.21 / 6.7.9 or later, or a kernel carrying the linked stable commits. Interim: disable async crypto offload for kTLS.

References