Linux kernel (net/tls): When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses as

Impact

When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses as more bytes arrive. A bogus record header made the parse fail without aborting the stream, so each retry copied more data into the same skb and eventually overflowed the allocated space - a remote out-of-bounds write in the receive path.

Who can reach it

Purely remote and pre-authentication with respect to the TLS session: a peer that can send to a kTLS RX socket manipulates the receive buffer state (syzbot did it with small out-of-band sends followed by a large normal send) and then supplies an invalid record length. Any tenant-facing or fabric-facing kTLS listener on the node is in scope; no local access needed.

What to do

Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for peer-facing services, or avoid small SO_RCVBUF settings on kTLS sockets - noting that a hostile peer influences the condition regardless.

References

Related entries

• Linux kernel (net/tls): If the skb clone that pins the input buffer for an async decrypt cannot be allocated, kTLSCVE-2025-40176 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): A particular kTLS ring state builds a scatterlist whose chain link points directly at anotherCVE-2026-64046 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back toCVE-2026-64047 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High