Cloudanix VulnDB

CVE-2026-80852

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's handling of encrypted network connections can let an attacker crash the whole system or potentially run code with full privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Out-of-bounds write in tls_append_frag() when MSG_MORE and TLS_TX_ZEROCOPY_RO allow num_frags to exceed MAX_SKB_FRAGS without boundary checks, corrupting adjacent kernel structures including destruct_work and enabling later invalid execution.

Why it matters to the business

Systems using TLS hardware offload or netdevsim emulation face kernel crashes, memory corruption, or potential code execution; high-availability or network-heavy workloads are most exposed, with remediation urgency increasing for any production kernel still shipping the vulnerable tls_device.c logic.

How an attack unfolds

An attacker opens a TLS socket configured for zerocopy offload, then issues repeated splice(SPLICE_F_MORE) calls of small byte counts; the MSG_MORE early exit bypasses the frag-room check, tls_append_frag() writes past the frags array, tls_push_record() indexes into sg_tx_data, and the workqueue later dereferences the corrupted destruct_work pointer.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the MSG_MORE early-break and missing frag-count check in tls_device.c; rebuild and reboot any systems that rely on TLS offload or netdevsim emulation.

How to confirm the fix worked

Confirm the running kernel no longer contains the vulnerable tls_append_frag path by inspecting net/tls/tls_device.c for the added record-push logic or by running the original syzkaller reproducer under KASAN; verify absence of the reported slab-out-of-bounds and array-index-out-of-bounds warnings.

Typical attack path

  1. Configure TLS socket with TX zerocopy offload enabled
  2. Loop splice() syscalls supplying one or two bytes each time with SPLICE_F_MORE
  3. Trigger tls_push_data() via sendmsg or implicit push on record full
  4. Overflow tls_record_info.frags[] and subsequent sg_tx_data[] structures
  5. Force record push to schedule ktls_device_destruct workqueue item
  6. Execute or crash via corrupted function pointer or NX page access

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds or UBSAN array-index-out-of-bounds messages that name tls_append_frag, tls_push_data, or tls_device.c; also look for workqueue crashes in ktls_device_destruct and page-fault attempts on NX pages during splice or sendmsg activity on TLS sockets.

  • KASAN: slab-out-of-bounds in tls_append_frag
  • tls_device.c:269
  • index 18 is out of range for type 'skb_frag_t [17]'
  • ktls_device_destruct
  • BUG: unable to handle page fault for address.*tls_oob

What your security team should do

  • Apply the upstream kernel patch or distribution update immediately on any host exposing TLS offload sockets
  • Disable TLS_TX_ZEROCOPY_RO on untrusted or externally reachable sockets until patched
  • Monitor kernel logs for KASAN/UBSAN reports referencing tls_device.c
  • Prioritize systems with netdevsim or hardware TLS offload NICs

The record

In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds write in tls_append_frag() Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation; tls_device.c is otherwise only reachable on a machine with a NIC that implements the offload. tls_push_data() only checks whether the open record still has room for another frag at the bottom of its loop, and the MSG_MORE early break skips that check. The record survives to the next syscall with the frag count it already had, and tls_append_frag() does not check either, so with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds a non-coalescing pipe page and num_frags walks off the end of tls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed, tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and the sg_set_page() writes land on the destruct_work that follows it, which the workqueue then calls. The byte limit is fine because copy drops to 0 and the loop falls through to the same check; the frag count has no such feedback. Push the record rather than keep a full one open, which is what a plain TCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and new_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw already sets full_record when the sk_msg ring fills up, MSG_MORE or not. BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269) Write of size 8 at addr ffff8881104d1530 by task tls_oob/450 CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) tls_append_frag (net/tls/tls_device.c:269) tls_push_data (net/tls/tls_device.c:518) tls_device_sendmsg (net/tls/tls_device.c:583) inet_sendmsg (net/ipv4/af_inet.c:865) sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813) splice_to_socket (fs/splice.c:884) do_splice (fs/splice.c:936 fs/splice.c:1349) __do_splice (fs/splice.c:1431) __x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> and, once the record is pushed: UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24 index 18 is out of range for type 'skb_frag_t [17]' UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41 index 18 is out of range for type 'scatterlist [17]' UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39 index 18 is out of range for type 'scatterlist [17]' UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38 index 26 is out of range for type 'scatterlist [17]' kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffea000411a680 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0011) - permissions violation Oops: Oops: 0011 [#1] SMP KASAN PTI Workqueue: ktls_device_destruct 0xffffea000411a680 RIP: 0010:0xffffea000411a680 Call Trace: <TASK> worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) </TASK>

Affected packages

Ecosystem Package Introduced Fixed