CVE-2026-80852

In the Linux kernel, the following vulnerability has been resolved:

tls: device: fix out-of-bounds write in tls append frag()

Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls device.c is otherwise only reachable on a machine with a NIC that implements the offload.

tls push data() only checks whether the open record still has room for another frag at the bottom of its loop, and the MSG MORE early break skips that check. The record survives to the next syscall with the frag count it already had, and tls append frag() does not check either, so with TLS TX ZEROCOPY RO every splice(SPLICE F MORE) of a byte or two adds a non-coalescing pipe page and num frags walks off the end of tls record info.frags[MAX SKB FRAGS]. Once the record is pushed, tls push record() runs the same index over sg tx data[MAX SKB FRAGS] and the sg set page() writes land on the destruct work that follows it, which the workqueue then calls.

The byte limit is fine because copy drops to 0 and the loop falls through to the same check; the frag count has no such feedback.

Push the record rather than keep a full one open, which is what a plain TCP socket does - tcp sendmsg locked() uses tcp mark push() and new segment in both the copy and the MSG SPLICE PAGES paths, and tls sw already sets full record when the sk msg ring fills up, MSG MORE or not.

BUG: KASAN: slab-out-of-bounds in tls append frag ( net/tls/tls device.c:269) Write of size 8 at addr ffff8881104d1530 by task tls oob/450

CPU: 2 UID: 0 PID: 450 Comm: tls oob Not tainted 7.2.0-rc7+ #329 PREEMPT Call Trace: dump stack lvl (lib/dump stack.c:94 lib/dump stack.c:120) print report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan report (mm/kasan/report.c:595) tls append frag (net/tls/tls device.c:269) tls push data (net/tls/tls device.c:518) tls device sendmsg (net/tls/tls device.c:583) inet sendmsg (net/ipv4/af inet.c:865) sock sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813) splice to socket (fs/splice.c:884) do splice (fs/splice.c:936 fs/splice.c:1349) do splice (fs/splice.c:1431) x64 sys splice (fs/splice.c:1634 fs/splice.c:1616) do syscall 64 (arch/x86/entry/syscall 64.c:63 arch/x86/entry/syscall 64.c:94) entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)

and, once the record is pushed:

UBSAN: array-index-out-of-bounds in net/tls/tls device.c:300:24 index 18 is out of range for type 'skb frag t [17]' UBSAN: array-index-out-of-bounds in net/tls/tls device.c:301:41 index 18 is out of range for type 'scatterlist [17]' UBSAN: array-index-out-of-bounds in net/tls/tls device.c:302:39 index 18 is out of range for type 'scatterlist [17]' UBSAN: array-index-out-of-bounds in net/tls/tls device.c:307:38 index 26 is out of range for type 'scatterlist [17]'

kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffea000411a680 #PF: supervisor instruction fetch in kernel mode #PF: error code(0x0011) - permissions violation Oops: Oops: 0011 [#1] SMP KASAN PTI Workqueue: ktls device destruct 0xffffea000411a680 RIP: 0010:0xffffea000411a680 Call Trace: worker thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret from fork (arch/x86/kernel/process.c:158) ret from fork asm (arch/x86/entry/entry 64.S:245)