Linux kernel (net/tls): KTLS never supported disconnect, but nothing stopped it. A connect(AF_UNSPEC) on a TLS socket

Impact

KTLS never supported disconnect, but nothing stopped it. A connect(AF_UNSPEC) on a TLS socket leaves the ULP, the strparser anchor and any NIC offload context pointing at torn-down state, and the receive path then walks it - the reported symptom is a warning in tls_strp_msg_load, with the underlying state confusion reachable in several worse shapes.

Who can reach it

Any unprivileged local process on the node can do it against its own socket: enable kTLS with setsockopt, then disconnect and keep reading. No device node, no capability, no cooperating peer. Every tenant container with a normal socket API reaches this.

What to do

Boot a kernel carrying the linked stable commits (which make disconnect on a TLS socket return an error). Interim: none at the tenant boundary - the syscall sequence is ordinary socket usage.

References