EUVD-2026-64547
GHSA-mfgw-4w39-hh3m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local socket access and a regular user account required to attach TLS ULP; kernel memory corruption yields full C/I/A impact with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tls: don't leave a full plaintext sk_msg ring unpushed
When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then adds to an already full ring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps onto sg.start and the ring appears empty. Fragments added after that overwrite live entries, and sg.size no longer matches what is reachable between sg.start and sg.end, so pushing the record runs the scatterwalk off the end of the scatterlist.
An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0
Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop.
AnalysisAI
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in tls_sw_sendmsg_locked(): when the copy path fills the plaintext sk_msg scatter-gather ring, it omits setting full_record, leaving the full ring unpushed; a subsequent splice() call then wraps sg.end back to sg.start, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with the ability to create TCP sockets - no elevated privileges are needed, as `setsockopt(TCP_ULP, "tls")` is accessible to unprivileged users on standard Linux configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the attack profile: local access with a regular user account, no complexity barrier once the technique is known, and full C/I/A impact consistent with a kernel memory-corruption primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard shell account creates a loopback TCP socket pair, attaches the `tls` ULP via `setsockopt(TCP_ULP, "tls")`, configures AES-128-GCM, then sends data via `sendmsg()` in a volume calculated to fill - but not flush - the `sk_msg` plaintext ring, and immediately follows with a `splice()` call. This triggers the wraparound: `sg.end` rolls back to `sg.start`, subsequent splice fragments overwrite live scatter entries, and the next `sendmsg()` drives the scatterwalk off the end of the scatterlist, producing a kernel NULL pointer dereference. … |
| Remediation | Apply the vendor-released kernel patch for the appropriate stable branch: upgrade to Linux 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with kernel TLS in use and obtain the vendor-released kernel patch from your distribution provider. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today