tls: device: fix out-of-bounds write in tls_append_frag()
In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds write in tls_append_frag() Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls_device.c is otherwise only reachable on a machine with a NIC that implements the offload. tls_push_data() only checks whether the open record still has room for another frag at the bottom of its loop, and the MSG_MORE early break skips that check. The record survives to the next syscall with the frag count it already had, and tls_append_frag() does not check either, so with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds a non-coalescing pipe page and num_frags walks off the end of tls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed, tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and the sg_set_page() writes land on the destruct_work that follows it, which the workqueue then calls. The byte limit is fine because copy drops to 0 and the loop falls through to the same check; the frag count has no such feedback. Push the record rather than keep a full one open, which is what a plain TCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and new_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw already sets full_record when the sk_msg ring fills up, MSG_MORE or not. BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269) Write of size 8 at addr ffff88811
CVE-2026-80852
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80852
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "03ced5da6120965d80ed56dbb7d78fa5c9128906",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "a832d7cb09da2a8e4e9734b4be14d3e76169d805",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "b7f10d4ff987bda038df90052cd4a1434a7412d4",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "fadbc1ed2a872a8649a44cf9e1cf9621fc58cd6e",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "cd7e875b89597f3498917af764758391338d1802",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "7e1208c135618358da5d7d6664874dc6e53c62fc",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f69799810c32dd40c6724d829eccc70baad07f",
"lessThan": "b17cf742eaad70ae29ac558cefb3aa9bbeea03d4",
"versionType": "git"
}
],
"programFiles": [
"net/tls/tls_device.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/tls/tls_device.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80852
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34867 · Revision 1
- Added to Heist Feed
- Publisher date