CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fail tls sw splice read() after a failed async decrypt

When an async decrypt fails, tls decrypt done() records the error in ctx->async wait.err and calls tls err abort(), which stores it in sk err. tls sw recvmsg() and tls sw read sock() each read async wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.

tls sw splice read() has no such check, and sk err does not stand in for one. tls rx rec wait() tests sk err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock error() clears it, while async wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read sock() refuse to read.

Read async wait.err in tls sw splice read() as the other two readers do.