Linux kernel (net/tls): Tls_sw_recvmsg takes a psock reference before acquiring the reader lock and returns without

Impact

Tls_sw_recvmsg takes a psock reference before acquiring the reader lock and returns without dropping it if the lock fails, so every failed receive pins a psock forever. A tenant that loops interrupted receives on a kTLS+sockmap socket leaks kernel objects until the node runs out of memory.

Who can reach it

Local and unprivileged on the socket side - the reader lock fails on signal interruption or timeout, which the tenant controls. Requires the socket to also carry a BPF psock (sockmap), so it applies on nodes running a service mesh or CNI that combines sockmap with kTLS, not on plain kTLS sockets.

What to do

Boot a kernel carrying the linked stable commits. Interim: do not run sockmap/sk_msg policy over kTLS sockets, and cap per-tenant memory so a leak is bounded by the cgroup rather than the node.

References