CVE-2026-74610 (GCVE-0-2026-74610)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
tls: don't leave a full plaintext sk_msg ring unpushed
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist. An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0 Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < aa8b14647721b5a4958712b35cf43e3125d47753 (git)
Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < f634289a0b557a197c5f37284b623cefedfe73d5 (git)
Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 3fc5044796dd87b8d68be4207046f5ce2748174c (git)
Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 3c5f8f2aa57c647b83add4896aab64aac5fdedad (git)
Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 7bca91d63341274e857f4aeaad54d229405e93dc (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa8b14647721b5a4958712b35cf43e3125d47753",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "f634289a0b557a197c5f37284b623cefedfe73d5",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3fc5044796dd87b8d68be4207046f5ce2748174c",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3c5f8f2aa57c647b83add4896aab64aac5fdedad",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "7bca91d63341274e857f4aeaad54d229405e93dc",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0027t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed.  A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty.  Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from tls_sw_sendmsg() via local sendmsg/sendto/splice syscalls on a TCP socket with the tls ULP; the copy-then-splice sequence is driven by the sending process (commit repro: unprivileged user on loopback), not by remote TLS ciphertext on RX.\nAC:L - An attacker fully controls the vulnerable send path by crafting alternating copy and MSG_SPLICE_PAGES splice sequences on their kTLS socket until the plaintext sk_msg ring fills without full_record then wraps; no privileged races or special memory layout are required.\nPR:L - Any unprivileged local user can create a TCP socket, attach the tls ULP with TCP_ULP and SOL_TLS setsockopt (no capability checks in net/tls), and trigger the bug with sendmsg/splice as demonstrated on loopback.\nUI:N - Exploitation requires only the attacker\u0027s own socket I/O to sequence copy and splice operations; no action by another user or administrator is needed.\nS:U - Memory corruption occurs within kernel TLS/sk_msg state of the attacking process\u0027s connection context; there is no crossing of VM, container, or IOMMU security boundaries beyond ordinary kernel compromise.\nC:H - Corrupting a full sk_msg ring overwrites live scatterlist entries and desynchronizes sg.size from reachable fragments, so tls_push_record/AEAD scatterwalk can read past the scatterlist end; this class of kernel heap corruption is exploitable for arbitrary memory disclosure beyond the observed NULL deref.\nI:H - The wrap corrupts scatterlist metadata and drives out-of-bounds scatterwalk during GCM encryption, giving attacker-influenced overwrite primitives on kernel heap objects adjacent to sk_msg data, enabling control-flow hijack beyond the demonstrated crash.\nA:H - Pushing a corrupted record runs the AEAD scatterwalk off the scatterlist end, producing a kernel NULL pointer dereference in memcpy_from_scatterwalk during gcm_encrypt and crashing the host (commit oops trace)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:36.026Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"
        },
        {
          "url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"
        }
      ],
      "title": "tls: don\u0027t leave a full plaintext sk_msg ring unpushed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74610",
    "datePublished": "2026-08-22T15:31:56.813Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:36.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74610",
      "date": "2026-08-29",
      "epss": "0.00129",
      "percentile": "0.02799"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:44:59.000Z",
      "cve": "CVE-2026-74610",
      "id": "msrc_CVE-2026-74610",
      "initial_release_date": "2026-08-24T01:01:29.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tls: don\u0027t leave a full plaintext sk_msg ring unpushed",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74610.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74610\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:33.547\",\"lastModified\":\"2026-08-25T06:18:38.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: don\u0027t leave a full plaintext sk_msg ring unpushed\\n\\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\\nthe plaintext sk_msg ring, it does not set full_record, so the record is\\nleft full and unpushed.  A later splice() then adds to an already full\\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\\nonto sg.start and the ring appears empty.  Fragments added after that\\noverwrite live entries, and sg.size no longer matches what is reachable\\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\\nthe end of the scatterlist.\\n\\nAn unprivileged user can trigger this on a loopback TCP socket with the\\n\\\"tls\\\" ULP attached:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\\n  Call Trace:\\n   skcipher_walk_next+0x1d1/0x2c0\\n   gcm_encrypt_aesni_avx+0x1e9/0x220\\n   bpf_exec_tx_verdict+0x3bb/0x860\\n   tls_sw_sendmsg+0xa1a/0xca0\\n   __sys_sendto+0x1da/0x1f0\\n\\nSet full_record in the copy path when the ring becomes full, and push a\\nrecord that is already full on entry to the sendmsg loop.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe1e81d4f73b6cbaed4fcc476960d26770642842\",\"lessThan\":\"aa8b14647721b5a4958712b35cf43e3125d47753\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1e81d4f73b6cbaed4fcc476960d26770642842\",\"lessThan\":\"f634289a0b557a197c5f37284b623cefedfe73d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1e81d4f73b6cbaed4fcc476960d26770642842\",\"lessThan\":\"3fc5044796dd87b8d68be4207046f5ce2748174c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1e81d4f73b6cbaed4fcc476960d26770642842\",\"lessThan\":\"3c5f8f2aa57c647b83add4896aab64aac5fdedad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe1e81d4f73b6cbaed4fcc476960d26770642842\",\"lessThan\":\"7bca91d63341274e857f4aeaad54d229405e93dc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:49+00:00",
      "cve": "CVE-2026-74610",
      "id": "CVE-2026-74610",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tls: don\u0027t leave a full plaintext sk_msg ring unpushed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74610.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.