Linux kernel (net/tls): The strparser kept a stale reference to an skb that TCP had already coalesced away, and the

Impact

The strparser kept a stale reference to an skb that TCP had already coalesced away, and the check that all queued skbs share decrypt state then read freed slab memory. A remote peer controls the send pattern that makes TCP coalesce, so this is a network-reachable use-after-free in the kTLS receive path.

Who can reach it

Remote: the peer's segmentation pattern drives TCP's skb compaction while the local kTLS reader waits for a record. Any kTLS RX socket the peer can reach is in scope - tenant workloads, storage clients, control-plane connections. No local privilege or device node needed.

What to do

Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for connections to untrusted peers.

References

Related entries

• Linux kernel (net/tls): A zero-length record already sitting on the rx_list breaks the invariant that zero-copy decryptCVE-2025-39682 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses asCVE-2025-39946 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): If the skb clone that pins the input buffer for an async decrypt cannot be allocated, kTLSCVE-2025-40176 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): A particular kTLS ring state builds a scatterlist whose chain link points directly at anotherCVE-2026-64046 · Linux kernel (net/tls)Critical