CVE-2026-74610

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TLS implementation where the tls sw sendmsg locked() function fails to set the full record flag when a fragment fills the plaintext sk msg ring. This causes the record to remain full and unpushed. Subsequent splice() operations can add data to the already full ring because sk msg page add() lacks a fullness check, leading to a wrap-around where sg.end meets sg.start, making the ring appear empty. Subsequent fragments overwrite active entries, causing sg.size to mismatch the reachable data between sg.start and sg.end. Consequently, pushing the record causes the scatterwalk to exceed the scatterlist boundaries. An unprivileged user can trigger a kernel NULL pointer dereference via a loopback TCP socket with the "tls" ULP attached.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.