CVE-2026-74611

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-08-22 16:16:33.670000

Last modified

2026-10-30 13:20:03.240000

View original CVE JSON

{
  "id": "CVE-2026-74611",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-22T16:16:33.670",
  "lastModified": "2026-10-30T13:20:03.240",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: rx: restore msg_iter before TLS 1.3 optimistic retry\n\ntls_decrypt_sg() advances msg->msg_iter when it maps user pages for\nthe optimistic TLS 1.3 zero-copy path. If the decrypted record turns\nout not to be unpadded application data, tls_decrypt_sw() retries into\na kernel skb, but leaves the iterator advanced.\n\nThe subsequent copy from the skb then writes decrypted bytes again at\na later point in the caller iovecs while recvmsg() reports only the\npost-retry length. A TLS peer can trigger this after the receiver\nenables TLS_RX_EXPECT_NO_PAD.\n\nRevert the iterator by the number of bytes consumed by the optimistic\nmapping before retrying without zero-copy.\n\nAdd a selftest which sends a TLS 1.3 control record with\nTLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not\noverwrite later iovecs beyond the returned length."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntls: rx: restaurar msg_iter antes del reintento optimista de TLS 1.3\n\ntls_decrypt_sg() avanza msg -> msg_iter cuando mapea páginas de usuario para la ruta optimista de copia cero de TLS 1.3. Si el registro descifrado resulta no ser datos de aplicación sin relleno, tls_decrypt_sw() reintenta en un skb del kernel, pero deja el iterador avanzado.\n\nLa copia subsiguiente del skb luego escribe bytes descifrados de nuevo en un punto posterior en los iovecs del llamador mientras que recvmsg() informa solo la longitud posterior al reintento. Un par TLS puede activar esto después de que el receptor habilite TLS_RX_EXPECT_NO_PAD.\n\nRevertir el iterador por el número de bytes consumidos por el mapeo optimista antes de reintentar sin copia cero.\n\nAñadir una autoprueba que envía un registro de control TLS 1.3 con TLS_RX_EXPECT_NO_PAD habilitado y verifica que recvmsg() no sobrescribe iovecs posteriores más allá de la longitud devuelta."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/tls/tls_sw.c",
            "tools/testing/selftests/net/tls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "97004f3c17371ee1b259887298711e0604666688",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "c71bacacd59166adbea423a04e7474b0e8245b84",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "3c4e21b1bf8e666a1c141e0f5813ece929570deb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "68787940274ec89f41dc91b1a68ee1a16a90735f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "3c837266a734e2a22b24d2d567404a501d405835",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "lessThan": "1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/tls/tls_sw.c",
            "tools/testing/selftests/net/tls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.0",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.0",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.114",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.45",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.9",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T19:02:18.342764Z",
          "id": "CVE-2026-74611",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c4e21b1bf8e666a1c141e0f5813ece929570deb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c837266a734e2a22b24d2d567404a501d405835",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/68787940274ec89f41dc91b1a68ee1a16a90735f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/97004f3c17371ee1b259887298711e0604666688",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c71bacacd59166adbea423a04e7474b0e8245b84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}