CVE-2026-74611

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TLS receive path where tls decrypt sg() advances the msg->msg iter when mapping user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record is not unpadded application data, tls decrypt sw() retries the operation into a kernel skb but fails to revert the iterator. This causes subsequent copies from the skb to write decrypted bytes at an incorrect offset in the caller iovecs, while recvmsg() reports only the post-retry length. A remote TLS peer can trigger this behavior if the receiver has enabled TLS RX EXPECT NO PAD.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.