Use-after-free in Linux kernel TLS encryption error path (CVE-2026-31533)

A use-after-free vulnerability exists in the Linux kernel's TLS subsystem in the -EBUSY error path of tls_do_encryption(). When a crypto request is enqueued to the cryptd backlog and returns -EBUSY, both the async callback tls_encrypt_done() and the synchronous error path perform duplicate cleanup of encrypt_pending and the scatterlist entry, corrupting the encrypt_pending sentinel. This allows a subsequent sendmsg to free a TLS record via bpf_exec_tx_verdict() while a pending cryptd callback still references it, triggering a use-after-free when the callback fires on the freed record. Affected versions: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS We recommend updating to: linux-image-5.4.0-1077-xilinx-zynqmp 5.4.0-1077.81, linux-image-5.4.0-1105-ibm 5.4.0-1105.110, linux-image-5.4.0-1118-bluefield 5.4.0-1118.125, linux-image-5.4.0-1133-fips 5.4.0-1133.143, linux-image-5.4.0-1146-kvm 5.4.0-1146.155. CVSS 9.8 · our assessment: act_now Reference: https://ubuntu.com/security/notices/USN-8280-1 Details: https://vuln.today/cve/CVE-2026-31533