CVE-2026-74610
Received Received - Intake

NULL Pointer Dereference in Linux Kernel TLS Implementation

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist. An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0 Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74610
EUVD
EUVD-2026-64547

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a full plaintext message ring buffer is left unpushed in the TLS (Transport Layer Security) implementation. When a fragment fills the ring, it doesn't set a flag to indicate the record is complete, causing later operations to overwrite live entries. This leads to a kernel NULL pointer dereference when processing data.

Detection Guidance

This vulnerability may be detected by monitoring for kernel NULL pointer dereferences or memory corruption errors in TLS-related operations. Check kernel logs for messages like 'BUG: kernel NULL pointer dereference' or 'RIP: memcpy_from_scatterwalk'. Commands like 'dmesg | grep -i "null pointer"' or 'journalctl -k | grep -i "tls"' may help identify suspicious activity.

Impact Analysis

An unprivileged user could exploit this on a loopback TCP socket with TLS attached to crash the system via a kernel NULL pointer dereference. This could cause denial of service or potential privilege escalation if combined with other exploits.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Disable TLS offload on loopback TCP sockets if not required. Monitor kernel logs for signs of exploitation and restrict unprivileged user access to TLS-enabled sockets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart