CVE-2026-80852

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tls: device: fix out-of-bounds write in tls_append_frag()

Found with syzkaller and a local syzbot instance running on top of a

netdevsim TLS offload emulation; tls_device.c is otherwise only reachable

on a machine with a NIC that implements the offload.

tls_push_data() only checks whether the open record still has room for

another frag at the bottom of its loop, and the MSG_MORE early break

skips that check. The record survives to the next syscall with the frag

count it already had, and tls_append_frag() does not check either, so

with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds

a non-coalescing pipe page and num_frags walks off the end of

tls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,

tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and

the sg_set_page() writes land on the destruct_work that follows it, which

the workqueue then calls.

The byte limit i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References