Vulnerability-Lookup

GHSA-MFGW-4W39-HH3M

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

tls: don't leave a full plaintext sk_msg ring unpushed

When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.

An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached:

BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0

Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74610"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:33Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0027t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed.  A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty.  Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop.",
  "id": "GHSA-mfgw-4w39-hh3m",
  "modified": "2026-08-25T06:31:22Z",
  "published": "2026-08-22T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74610"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74610 (GCVE-0-2026-74610)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40

Title

tls: don't leave a full plaintext sk_msg ring unpushed

Summary

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist. An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0 Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/aa8b14647721b5a49…
https://git.kernel.org/stable/c/f634289a0b557a197…
https://git.kernel.org/stable/c/3fc5044796dd87b8d…
https://git.kernel.org/stable/c/3c5f8f2aa57c647b8…
https://git.kernel.org/stable/c/7bca91d63341274e8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < aa8b14647721b5a4958712b35cf43e3125d47753 (git) Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < f634289a0b557a197c5f37284b623cefedfe73d5 (git) Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 3fc5044796dd87b8d68be4207046f5ce2748174c (git) Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 3c5f8f2aa57c647b83add4896aab64aac5fdedad (git) Affected: fe1e81d4f73b6cbaed4fcc476960d26770642842 , < 7bca91d63341274e857f4aeaad54d229405e93dc (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa8b14647721b5a4958712b35cf43e3125d47753",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "f634289a0b557a197c5f37284b623cefedfe73d5",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3fc5044796dd87b8d68be4207046f5ce2748174c",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3c5f8f2aa57c647b83add4896aab64aac5fdedad",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "7bca91d63341274e857f4aeaad54d229405e93dc",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0027t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed.  A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty.  Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from tls_sw_sendmsg() via local sendmsg/sendto/splice syscalls on a TCP socket with the tls ULP; the copy-then-splice sequence is driven by the sending process (commit repro: unprivileged user on loopback), not by remote TLS ciphertext on RX.\nAC:L - An attacker fully controls the vulnerable send path by crafting alternating copy and MSG_SPLICE_PAGES splice sequences on their kTLS socket until the plaintext sk_msg ring fills without full_record then wraps; no privileged races or special memory layout are required.\nPR:L - Any unprivileged local user can create a TCP socket, attach the tls ULP with TCP_ULP and SOL_TLS setsockopt (no capability checks in net/tls), and trigger the bug with sendmsg/splice as demonstrated on loopback.\nUI:N - Exploitation requires only the attacker\u0027s own socket I/O to sequence copy and splice operations; no action by another user or administrator is needed.\nS:U - Memory corruption occurs within kernel TLS/sk_msg state of the attacking process\u0027s connection context; there is no crossing of VM, container, or IOMMU security boundaries beyond ordinary kernel compromise.\nC:H - Corrupting a full sk_msg ring overwrites live scatterlist entries and desynchronizes sg.size from reachable fragments, so tls_push_record/AEAD scatterwalk can read past the scatterlist end; this class of kernel heap corruption is exploitable for arbitrary memory disclosure beyond the observed NULL deref.\nI:H - The wrap corrupts scatterlist metadata and drives out-of-bounds scatterwalk during GCM encryption, giving attacker-influenced overwrite primitives on kernel heap objects adjacent to sk_msg data, enabling control-flow hijack beyond the demonstrated crash.\nA:H - Pushing a corrupted record runs the AEAD scatterwalk off the scatterlist end, producing a kernel NULL pointer dereference in memcpy_from_scatterwalk during gcm_encrypt and crashing the host (commit oops trace)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:36.026Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"
        },
        {
          "url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"
        }
      ],
      "title": "tls: don\u0027t leave a full plaintext sk_msg ring unpushed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74610",
    "datePublished": "2026-08-22T15:31:56.813Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:36.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-MFGW-4W39-HH3M

CVE-2026-74610 (GCVE-0-2026-74610)

Tags

Sightings

Nomenclature