CVE-2026-74611
Received Received - Intake

Buffer Overwrite in Linux Kernel TLS 1.3 Implementation

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74611
EUVD
EUVD-2026-64548

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the TLS 1.3 implementation where the message iterator is incorrectly advanced during decryption. When a decrypted record is not valid application data, the system retries decryption without zero-copy, but the iterator remains advanced. This causes decrypted bytes to overwrite later data in the caller's buffers, leading to potential data corruption or information leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's TLS implementation and may not have direct detection commands. Monitor kernel logs for TLS-related errors or crashes after enabling TLS_RX_EXPECT_NO_PAD. Check for unexpected data corruption in TLS 1.3 traffic.

Impact Analysis

An attacker could exploit this to overwrite sensitive data in memory, potentially leading to crashes, privilege escalation, or unauthorized access to information. Systems using TLS 1.3 with the affected kernel versions may be vulnerable to data corruption or leaks during encrypted communication.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality, violating requirements for secure data handling in GDPR and HIPAA. Unauthorized data modification or exposure may lead to non-compliance, legal penalties, or reputational damage for organizations relying on affected systems.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Disable TLS_RX_EXPECT_NO_PAD if not required. Review TLS 1.3 configurations for potential misconfigurations causing optimistic retry issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart