Linux kernel (net/tls): Splice with MSG_SPLICE_PAGES and MSG_MORE could push more pages into the plaintext scatterlist

Impact

Splice with MSG_SPLICE_PAGES and MSG_MORE could push more pages into the plaintext scatterlist than MAX_MSG_FRAGS allows. The code failed to mark the record full, fell through to the continue path and kept trying to add data to an already-full scatterlist - the bounds check catches it with a warning, but this is the zerocopy splice path overrunning its own frag budget on attacker-chosen input sizes.

Who can reach it

Local and unprivileged: any process with a kTLS socket calling splice()/sendfile() with MSG_MORE and more pages than fit in one record. Every tenant container can do this with plain socket and file syscalls - no device node, no capability. On a kernel booted with panic_on_warn this becomes a node-wide outage.

What to do

Boot a kernel carrying the linked stable commits. Interim: if the fleet runs panic_on_warn, that setting turns this into a tenant-triggerable node kill - weigh disabling it until patched.

References