Linux kernel (net/tls): When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses as

Impact

When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses as more bytes arrive. A bogus record header made the parse fail without aborting the stream, so each retry copied more data into the same skb and eventually overflowed the allocated space - a remote out-of-bounds write in the receive path.

Who can reach it

Purely remote and pre-authentication with respect to the TLS session: a peer that can send to a kTLS RX socket manipulates the receive buffer state (syzbot did it with small out-of-band sends followed by a large normal send) and then supplies an invalid record length. Any tenant-facing or fabric-facing kTLS listener on the node is in scope; no local access needed.

What to do

Boot a kernel carrying the linked stable commits. Interim: terminate TLS in userspace for peer-facing services, or avoid small SO_RCVBUF settings on kTLS sockets - noting that a hostile peer influences the condition regardless.

References