Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back to

Impact

When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back to the head is planted one entry short of the true last slot. The crypto layer is then handed a scatter list that describes the wrong memory, so a TLS record is encrypted from - and written into - buffers the socket does not own. That is attacker-influenceable memory corruption plus plaintext confusion on the encrypted control and storage plane: bytes from an unrelated buffer can end up inside a record on the wire.

Who can reach it

Any local process that owns a socket and enables kTLS via setsockopt(TLS_TX), which every tenant container can do without privilege. The bug needs the send ring to wrap, which happens naturally with sustained scatter-gather sends; a tenant can arrange it deliberately with a chosen write pattern. The CNA scores it network-reachable because a peer's flow-control behaviour shapes when the ring wraps. No device node required.

What to do

Boot a kernel carrying the fix commits below - the version field in the record (5.5) marks where the flaw was introduced, not a fixed release, so match by commit against your vendor kernel. Interim control: blacklist the tls ULP so tenant workloads use userspace TLS until nodes are rebooted.

References