{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74610", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:31:56.813Z", "dateUpdated": "2026-08-25T05:40:36.026Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:36.026Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don't leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed. A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty. Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n Call Trace:\n skcipher_walk_next+0x1d1/0x2c0\n gcm_encrypt_aesni_avx+0x1e9/0x220\n bpf_exec_tx_verdict+0x3bb/0x860\n tls_sw_sendmsg+0xa1a/0xca0\n __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached from tls_sw_sendmsg() via local sendmsg/sendto/splice syscalls on a TCP socket with the tls ULP; the copy-then-splice sequence is driven by the sending process (commit repro: unprivileged user on loopback), not by remote TLS ciphertext on RX.\nAC:L - An attacker fully controls the vulnerable send path by crafting alternating copy and MSG_SPLICE_PAGES splice sequences on their kTLS socket until the plaintext sk_msg ring fills without full_record then wraps; no privileged races or special memory layout are required.\nPR:L - Any unprivileged local user can create a TCP socket, attach the tls ULP with TCP_ULP and SOL_TLS setsockopt (no capability checks in net/tls), and trigger the bug with sendmsg/splice as demonstrated on loopback.\nUI:N - Exploitation requires only the attacker's own socket I/O to sequence copy and splice operations; no action by another user or administrator is needed.\nS:U - Memory corruption occurs within kernel TLS/sk_msg state of the attacking process's connection context; there is no crossing of VM, container, or IOMMU security boundaries beyond ordinary kernel compromise.\nC:H - Corrupting a full sk_msg ring overwrites live scatterlist entries and desynchronizes sg.size from reachable fragments, so tls_push_record/AEAD scatterwalk can read past the scatterlist end; this class of kernel heap corruption is exploitable for arbitrary memory disclosure beyond the observed NULL deref.\nI:H - The wrap corrupts scatterlist metadata and drives out-of-bounds scatterwalk during GCM encryption, giving attacker-influenced overwrite primitives on kernel heap objects adjacent to sk_msg data, enabling control-flow hijack beyond the demonstrated crash.\nA:H - Pushing a corrupted record runs the AEAD scatterwalk off the scatterlist end, producing a kernel NULL pointer dereference in memcpy_from_scatterwalk during gcm_encrypt and crashing the host (commit oops trace)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_sw.c"], "versions": [{"version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "lessThan": "aa8b14647721b5a4958712b35cf43e3125d47753", "status": "affected", "versionType": "git"}, {"version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "lessThan": "f634289a0b557a197c5f37284b623cefedfe73d5", "status": "affected", "versionType": "git"}, {"version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "lessThan": "3fc5044796dd87b8d68be4207046f5ce2748174c", "status": "affected", "versionType": "git"}, {"version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "lessThan": "3c5f8f2aa57c647b83add4896aab64aac5fdedad", "status": "affected", "versionType": "git"}, {"version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "lessThan": "7bca91d63341274e857f4aeaad54d229405e93dc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_sw.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"}, {"url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"}, {"url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"}, {"url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"}, {"url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"}], "title": "tls: don't leave a full plaintext sk_msg ring unpushed", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tls/tls_sw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aa8b14647721b5a4958712b35cf43e3125d47753", "status": "affected", "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "versionType": "git"}, {"lessThan": "f634289a0b557a197c5f37284b623cefedfe73d5", "status": "affected", "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "versionType": "git"}, {"lessThan": "3fc5044796dd87b8d68be4207046f5ce2748174c", "status": "affected", "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "versionType": "git"}, {"lessThan": "3c5f8f2aa57c647b83add4896aab64aac5fdedad", "status": "affected", "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "versionType": "git"}, {"lessThan": "7bca91d63341274e857f4aeaad54d229405e93dc", "status": "affected", "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tls/tls_sw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don't leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed. A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty. Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n Call Trace:\n skcipher_walk_next+0x1d1/0x2c0\n gcm_encrypt_aesni_avx+0x1e9/0x220\n bpf_exec_tx_verdict+0x3bb/0x860\n tls_sw_sendmsg+0xa1a/0xca0\n __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop."}], "id": "CVE-2026-74610", "lastModified": "2026-08-25T06:18:38.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:33.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tls: don't leave a full plaintext sk_msg ring unpushed", "id": "2521497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521497"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntls: don't leave a full plaintext sk_msg ring unpushed\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed. A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty. Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nRIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\nCall Trace:\nskcipher_walk_next+0x1d1/0x2c0\ngcm_encrypt_aesni_avx+0x1e9/0x220\nbpf_exec_tx_verdict+0x3bb/0x860\ntls_sw_sendmsg+0xa1a/0xca0\n__sys_sendto+0x1da/0x1f0\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop.", "A flaw was found in the Linux kernel's Transport Layer Security (TLS) implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol (ULP) attached. This vulnerability occurs because the TLS software send message function does not correctly handle a full plaintext message ring, leading to memory corruption and a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-74610", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74610\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74610\nhttps://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74610-3bed@gregkh/T"], "threat_severity": "Moderate"}