CVE-2026-80904net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- —Not scoredno CVSS score yet
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection. tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read. Read async_wait.err in tls_sw_splice_read() as the other two readers do.
Timeline
ID reserved
By Linux
- 9 days later
· 9 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < a808aadff634c7a408b2ab84d5919e9a741fdb5b
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < 06c2a53604fa1dc4820063828d7dadb3675b7af8
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < 18ae1e95f20867106a28820c208a9cec99dda861
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < 82d9269f01ebfd835b6256aa17016a974cbbc647
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < 4b177911eb9f799e9841c2f87c75b08cb112757a
- affected f314bfee81b1bf8e01168177b2f65f24eb8da63a – < 976df67f463db1fddaf2a32fb04f57ad2891a23d
- affected 5.19
- unaffected < 5.19
- unaffected 6.1.184 – ≤ 6.1.*
- unaffected 6.6.153 – ≤ 6.6.*
- unaffected 6.12.105 – ≤ 6.12.*
- unaffected 6.18.46 – ≤ 6.18.*
- unaffected 7.1.10 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b (opens in a new tab)
- https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8 (opens in a new tab)
- https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861 (opens in a new tab)
- https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647 (opens in a new tab)
- https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a (opens in a new tab)
- https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-71663 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80904)Record last updated .