Linux Kernel EUVD-2026-59229

The vulnerability resides in the Linux kernel's net/tls subsystem (tls_sw.c), specifically the tls_sw_read_sock() receive path used by kernel TLS offloading (kTLS). TLS 1.3 (RFC 8446, Section 5.1) explicitly permits zero-length application_data records as a traffic-analysis countermeasure, so receiving them is standards-compliant behavior. When the kernel decrypts such a record, full_len equals zero; the read_actor callback has no payload to process and returns zero, which the receive loop incorrectly treats as a backpressure signal. The empty skb is re-enqueued at the head of rx_list on every iteration, creating a loop with an unreachable exit condition (CWE-835 class) that blocks every subsequent record queued behind it. The sibling path tls_sw_recvmsg() already handles this correctly by falling through to consume_skb() after copying nothing; the fix mirrors that behavior in tls_sw_read_sock(). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches starting from commit 662fbcec32f4af6bdcf5b4006b792ebe9543d945.