CVE-2026-72330
Received Received - Intake

Denial of Service in Linux Kernel TLS

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls_sw_read_sock() A peer may send a zero-length TLS application_data record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure (RFC 8446, Section 5.1). After decryption such a record has full_len == 0. tls_sw_read_sock() hands it to the read_actor, which has no payload to consume and returns zero. The loop treats a zero return as backpressure (used <= 0), requeues the skb at the head of rx_list, and stops. rx_list is serviced head-first on the next call, so the empty record is dequeued, fails the same way, and is requeued again; every later record on the connection is blocked behind it. tls_sw_recvmsg() does not stall on this: a zero-length data record copies nothing and falls through to consume_skb(). Mirror that in the read_sock() path by recognizing an empty data record before the actor runs, consuming it, and continuing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72330
EUVD
EUVD-2026-59229

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the TLS (Transport Layer Security) implementation. A peer can send a zero-length TLS application_data record, which is allowed by TLS 1.3 as a traffic-analysis countermeasure. The kernel's tls_sw_read_sock() function mishandles these empty records, causing a loop that requeues the record repeatedly and blocks subsequent data from being processed.

Detection Guidance

This vulnerability affects the Linux kernel's TLS implementation and may cause network stalls when processing empty TLS records. Detection requires checking kernel logs for stalled TLS connections or unusual network traffic patterns. Monitor for connections stuck in the TLS handshake or data transfer phase without progress.

Impact Analysis

This vulnerability can cause a denial-of-service condition on affected systems. Network connections using TLS may stall or become unresponsive if an attacker sends crafted empty TLS records, disrupting legitimate traffic and services.

Mitigation Strategies

Apply the latest Linux kernel security patches to resolve this issue. If immediate patching is not possible, consider disabling TLS 1.3 support temporarily or monitoring affected connections for stalled traffic. Restarting the TLS service or affected applications may help clear stuck connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart