CVE-2026-80904net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection. tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read. Read async_wait.err in tls_sw_splice_read() as the other two readers do.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f314bfee81b1bf8e01168177b2f65f24eb8da63a before a808aadff634c7a408b2ab84d5919e9a741fdb5b; from f314bfee81b1bf8e01168177b2f65f24eb8da63a before 06c2a53604fa1dc4820063828d7dadb3675b7af8; from f314bfee81b1bf8e01168177b2f65f24eb8da63a before 18ae1e95f20867106a28820c208a9cec99dda861; from f314bfee81b1bf8e01168177b2f65f24eb8da63a before 82d9269f01ebfd835b6256aa17016a974cbbc647; from f314bfee81b1bf8e01168177b2f65f24eb8da63a before 4b177911eb9f799e9841c2f87c75b08cb112757a; from f314bfee81b1bf8e01168177b2f65f24eb8da63a before 976df67f463db1fddaf2a32fb04f57ad2891a23d | CNA record |
References
- https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b
- https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8
- https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861
- https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647
- https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a
- https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.