Linux kernel (net/tls): The strparser kept a stale reference to an skb that TCP had already coalesced away, and the

Impact

The strparser kept a stale reference to an skb that TCP had already coalesced away, and the check that all queued skbs share decrypt state then read freed slab memory. A remote peer controls the send pattern that makes TCP coalesce, so this is a network-reachable use-after-free in the kTLS receive path.

Who can reach it

Remote: the peer's segmentation pattern drives TCP's skb compaction while the local kTLS reader waits for a record. Any kTLS RX socket the peer can reach is in scope - tenant workloads, storage clients, control-plane connections. No local privilege or device node needed.

What to do

Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for connections to untrusted peers.

References