CVE-2026-74610 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
tls: don't leave a full plaintext sk_msg ring unpushed
When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.
An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0
Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified as CVE-2024-something within the Linux kernel's TLS software implementation represents a critical memory management flaw rooted in improper state tracking of scatter-gather list rings. Specifically, the issue resides in the tls_sw_sendmsg_locked function where the logic for handling plaintext sk_msg ring buffers fails to correctly update internal flags when the buffer reaches capacity. When the copy path adds a fragment that completes the plaintext sk_msg ring, it neglects to set the full_record flag. This omission leaves the record in a state where it is technically full but marked as unpushed, creating a discrepancy between the actual memory usage and the kernel's internal bookkeeping of available space.
This incorrect state triggers a cascading failure during subsequent system calls that interact with the socket buffer, particularly when splice() operations are performed on an already full ring. The function sk_msg_page_add lacks its own check for ring fullness because it relies on the assumption that previous steps have correctly managed the record status. Consequently, when new data is added to this mismanaged ring, the scatterlist end pointer wraps around to match the start pointer due to circular buffer mechanics. This wrapping causes the kernel to incorrectly perceive the ring as empty or having significant free space available, despite it being fully occupied by live entries from previous operations.
The operational impact of this flaw is severe, leading to memory corruption and potential denial of service conditions for local users. As fragments are added based on the false assumption that space exists, they overwrite existing live data structures within the scatterlist. This overwriting corrupts the integrity of sg.size relative to the actual reachable range between sg.start and sg.end pointers. When the system eventually attempts to push this corrupted record for transmission or processing, it executes a scatterwalk operation that proceeds off the end of the allocated memory buffer. The provided crash trace confirms this outcome, showing a kernel NULL pointer dereference occurring during memcpy_from_scatterwalk, which is invoked by skcipher_walk_next and subsequently gcm_encrypt_aesni_avx. This indicates that the cryptographic acceleration routines are attempting to access invalid or null memory addresses due to the corrupted scatterlist pointers.
From a security classification perspective, this vulnerability aligns with CWE-120 Buffer Overflow without bounds check in C/C++ as well as CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization of Actions leading to Race Condition, although it is primarily an internal state management error rather than a traditional race condition. In the context of the MITRE ATT&CK framework, this flaw could be leveraged for Local Privilege Escalation if an attacker can trigger the crash in a way that allows control over execution flow or information disclosure through memory corruption artifacts, although the immediate manifestation is a denial of service via kernel panic. The vulnerability requires local access and specifically involves TCP sockets with TLS User Level Protocol attached, limiting its remote exploitability but increasing risk for systems handling encrypted traffic locally.
Mitigation strategies focus on applying vendor-provided kernel patches that correct the logic within tls_sw_sendmsg_locked. The fix ensures that when the plaintext sk_msg ring becomes full during a copy operation, the full_record flag is properly set to reflect this state. Additionally, the patch implements logic to push records that are already full upon entry into the sendmsg loop, preventing the accumulation of unpushed data that leads to the subsequent corruption. System administrators should ensure their Linux kernels are updated with these specific TLS subsystem fixes. For environments where immediate patching is not possible, restricting access to local TCP sockets and disabling unnecessary ULP attachments can reduce the attack surface, though complete mitigation requires updating the kernel binary itself to resolve the underlying memory management defect.