CVE-2026-80904

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fail tls_sw_splice_read() after a failed async decrypt

When an async decrypt fails, tls_decrypt_done() records the error in

ctx->async_wait.err and calls tls_err_abort(), which stores it in

sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read

async_wait.err once they hold the reader lock and fail the call: a

record that did not authenticate breaks the connection.

tls_sw_splice_read() has no such check, and sk_err does not stand in

for one. tls_rx_rec_wait() tests sk_err only inside the loop it

skips whenever a record is already parsed, and the first reader to

reach sock_error() clears it, while async_wait.err persists. A

splice therefore keeps delivering records on a connection that

recvmsg() and read_sock() refuse to read.

Read async_wait.err in tls_sw_splice_read() as the other two readers

do.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References