Database/Kernel, userspace & hypervisor
Linux kernel (net/tls): The synchronous decrypt path shared refcounting and completion state with the async path, so a
Impact
The synchronous decrypt path shared refcounting and completion state with the async path, so a decrypt that was never actually asynchronous still went through the async wake-up dance. The kernel CNA scores this as a remotely reachable high-impact issue in the record decrypt path; it is also the prerequisite for the async-decrypt use-after-free fixes that follow it.
Who can reach it
The decrypt path is driven by whatever peer is sending records to a kTLS RX socket, so exposure follows every kTLS listener on the node. Practically, patch it as part of the tls async-decrypt cluster (CVE-2024-26582 / -26583 / -26584 / -26800 / CVE-2025-40176) rather than on its own - splitting them leaves the later fixes applied on top of the state this one cleans up.
What to do
Boot a kernel carrying the linked stable commits, together with the rest of the tls async-decrypt series. Interim: disable async crypto offload for kTLS so the synchronous path is used.
References
Related entries
- Linux kernel (net/tls): The strparser kept a stale reference to an skb that TCP had already coalesced away, and theCVE-2025-38471 · Linux kernel (net/tls)Critical
- Linux kernel (net/tls): A zero-length record already sitting on the rx_list breaks the invariant that zero-copy decryptCVE-2025-39682 · Linux kernel (net/tls)Critical
- Linux kernel (net/tls): When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses asCVE-2025-39946 · Linux kernel (net/tls)Critical
- Linux kernel (net/tls): If the skb clone that pins the input buffer for an async decrypt cannot be allocated, kTLSCVE-2025-40176 · Linux kernel (net/tls)Critical
- Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
- Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.