net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Summary
| CVE | CVE-2026-80904 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-04 18:17:59 UTC |
|---|
| Updated | 2026-09-04 18:17:59 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
When an async decrypt fails, tls_decrypt_done() records the error in
ctx->async_wait.err and calls tls_err_abort(), which stores it in
sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
async_wait.err once they hold the reader lock and fail the call: a
record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in
for one. tls_rx_rec_wait() tests sk_err only inside the loop it
skips whenever a record is already parsed, and the first reader to
reach sock_error() clears it, while async_wait.err persists. A
splice therefore keeps delivering records on a connection that
recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers
do. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a a808aadff634c7a408b2ab84d5919e9a741fdb5b git |
Not specified |
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a 06c2a53604fa1dc4820063828d7dadb3675b7af8 git |
Not specified |
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a 18ae1e95f20867106a28820c208a9cec99dda861 git |
Not specified |
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a 82d9269f01ebfd835b6256aa17016a974cbbc647 git |
Not specified |
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a 4b177911eb9f799e9841c2f87c75b08cb112757a git |
Not specified |
| CNA |
Linux |
Linux |
affected f314bfee81b1bf8e01168177b2f65f24eb8da63a 976df67f463db1fddaf2a32fb04f57ad2891a23d git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.19 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.19 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.184 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.153 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.105 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.46 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.10 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.