CVE-2026-80852 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
tls: device: fix out-of-bounds write in tls_append_frag()
Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls_device.c is otherwise only reachable on a machine with a NIC that implements the offload.
tls_push_data() only checks whether the open record still has room for another frag at the bottom of its loop, and the MSG_MORE early break skips that check. The record survives to the next syscall with the frag count it already had, and tls_append_frag() does not check either, so with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds a non-coalescing pipe page and num_frags walks off the end of tls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,
tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and
the sg_set_page() writes land on the destruct_work that follows it, which the workqueue then calls.
The byte limit is fine because copy drops to 0 and the loop falls through to the same check; the frag count has no such feedback.
Push the record rather than keep a full one open, which is what a plain TCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and new_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw already sets full_record when the sk_msg ring fills up, MSG_MORE or not.
BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269) Write of size 8 at addr ffff8881104d1530 by task tls_oob/450
CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) tls_append_frag (net/tls/tls_device.c:269) tls_push_data (net/tls/tls_device.c:518) tls_device_sendmsg (net/tls/tls_device.c:583) inet_sendmsg (net/ipv4/af_inet.c:865) sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813) splice_to_socket (fs/splice.c:884) do_splice (fs/splice.c:936 fs/splice.c:1349) __do_splice (fs/splice.c:1431) __x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK>
and, once the record is pushed:
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24 index 18 is out of range for type 'skb_frag_t [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41 index 18 is out of range for type 'scatterlist [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39 index 18 is out of range for type 'scatterlist [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38 index 26 is out of range for type 'scatterlist [17]'
kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffea000411a680 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0011) - permissions violation Oops: Oops: 0011 [#1] SMP KASAN PTI
Workqueue: ktls_device_destruct 0xffffea000411a680 RIP: 0010:0xffffea000411a680 Call Trace: <TASK> worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK>
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel TLS subsystem contains a critical out-of-bounds write vulnerability within the tls_append_frag function, located in net/tls/tls_device.c. This flaw arises from an incomplete validation of fragment counts when handling data with specific socket flags, particularly MSG_MORE and SPLICE_F_MORE during splice operations. The root cause lies in the logic flow of tls_push_data, which is responsible for managing TLS record construction. While this function checks whether an open record has sufficient space to accommodate a new fragment at the bottom of its loop, it fails to perform this check when the MSG_MORE flag triggers an early break condition. Consequently, if a user application sends data with these flags set, the current TLS record is not pushed or finalized even though it may already be full. The record remains open and retains its existing frag count for subsequent system calls.
When tls_append_frag is subsequently invoked to add more fragments to this incomplete but effectively full record, it does not verify if adding another fragment would exceed the maximum allowed limit defined by MAX_SKB_FRAGS. This lack of boundary checking allows an attacker or a buggy application to incrementally append non-coalescing pipe pages via splice operations with SPLICE_F_MORE flags. Each such operation adds a new fragment without resetting or validating the total count against the array size limits. As num_frags exceeds the allocated capacity, it walks off the end of the tls_record_info.frags array. This results in a slab-out-of-bounds write error, as detected by KASAN during testing with syzkaller and netdevsim TLS offload emulation environments.
The operational impact of this vulnerability is severe, extending beyond simple memory corruption to potential code execution. Once the corrupted record is eventually pushed via tls_push_record, the system attempts to iterate over the sg_tx_data array using the same invalid index values. This leads to multiple out-of-bounds accesses in scatterlist structures as reported by UBSAN, with indices exceeding the range of type skb_frag_t and scatterlist arrays sized at 17 elements. More critically, because the fragment count is unchecked during accumulation, writes can overwrite adjacent kernel memory structures. In this specific instance, the overflow overwrites the destruct_work structure that follows the frags array in memory layout. When the workqueue later executes tls_device_destruct to clean up resources, it invokes a function pointer located within the overwritten area. Since an attacker controls the data being spliced into these fragments, they can inject malicious code pointers or shellcode into this location. The subsequent execution of this corrupted pointer results in a page fault on an NX-protected page, indicating an attempted arbitrary kernel code execution with root privileges.
This vulnerability is classified under CWE-787: Out-of-bounds Write and aligns with ATT&CK techniques related to privilege escalation through memory corruption exploits such as T1059 or specific kernel exploitation vectors like T1203 if it leads to remote code execution, though this instance primarily demonstrates local root compromise via crafted syscalls. The flaw highlights a common class of issues in network stack processing where state management across multiple system calls fails to enforce strict boundary constraints on internal buffers. To mitigate this risk, the fix involves modifying tls_push_data to push the record immediately when it is full, rather than keeping it open with MSG_MORE set. This behavior aligns with standard TCP socket handling logic found in tcp_sendmsg_locked, which uses tcp_mark_push and new_segment to ensure records are finalized appropriately regardless of splice flags. By ensuring that a full record is pushed before attempting to append further fragments, the kernel prevents the accumulation of excessive fragment counts that lead to buffer overflows. System administrators should apply kernel updates containing this patch immediately to prevent potential local privilege escalation attacks targeting TLS offloading capabilities on supported network interface cards.