Linux kernel (net/tls): A non-DATA record already copied out of the pending list could be merged with a second record

Impact

A non-DATA record already copied out of the pending list could be merged with a second record of the same type from the queue, so control-plane records (alerts, handshake/key-update messages) and application data get concatenated into one recv() result. The application's view of record boundaries and record types stops matching what the peer actually sent - a protocol-level record-type confusion the peer chooses.

Who can reach it

Remote: the peer decides record types and ordering, so it can arrange a non-DATA record on the rx_list followed by another of the same type. Any kTLS RX socket the peer can reach; no local privilege or device node required. TLS 1.3 makes it easier because the type is only known after decryption.

What to do

Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for peer-facing services if the application relies on record-type boundaries (key update, alert handling).

References