CVE-2026-80852

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1

Description An out-of-bounds write exists in the tls append frag() function within the Linux kernel. The issue occurs when tls push data() fails to properly check for available space in an open record due to an early break triggered by MSG MORE. When using TLS TX ZEROCOPY RO, repeated calls to splice() with SPLICE F MORE can cause the fragment count to exceed the bounds of tls record info.frags[MAX SKB FRAGS]. Subsequently, tls push record() may write beyond the bounds of sg tx data[MAX SKB FRAGS], potentially overwriting destruct work and leading to kernel crashes or arbitrary code execution. This issue is specifically reachable on systems with a Network Interface Card (NIC) that implements TLS offload.

Recommendations Update the Linux kernel to version 7.2.5-1.1 or later.