Database/Kernel, userspace & hypervisor
Linux kernel (net/tls): A non-DATA record already copied out of the pending list could be merged with a second record
Impact
A non-DATA record already copied out of the pending list could be merged with a second record of the same type from the queue, so control-plane records (alerts, handshake/key-update messages) and application data get concatenated into one recv() result. The application's view of record boundaries and record types stops matching what the peer actually sent - a protocol-level record-type confusion the peer chooses.
Who can reach it
Remote: the peer decides record types and ordering, so it can arrange a non-DATA record on the rx_list followed by another of the same type. Any kTLS RX socket the peer can reach; no local privilege or device node required. TLS 1.3 makes it easier because the type is only known after decryption.
What to do
Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for peer-facing services if the application relies on record-type boundaries (key update, alert handling).
References
Related entries
- Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
- Linux kernel (net/tls): KTLS never supported disconnect, but nothing stopped it. A connect(AF_UNSPEC) on a TLS socketCVE-2025-37756 · Linux kernel (net/tls)High
- Linux kernel (net/tls): A BPF verdict that grows the scatterlist (bpf_msg_push_data) combined with a cork_bytes settingCVE-2025-38166 · Linux kernel (net/tls)High
- Linux kernel (net/tls): KTLS assumes it owns the TCP receive queue. When another reader drains bytes first, the oldCVE-2025-38616 · Linux kernel (net/tls)High
- Linux kernel (net/tls): The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device itCVE-2025-40149 · Linux kernel (net/tls)High
- Linux kernel (net/tls): A receiver that holds its TCP window at zero keeps the kTLS sender blocked inside tx_lockCVE-2023-54306 · Linux kernel (net/tls)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.