TCP/IP Stack Vulnerability in Linux Kernel

CVE-2026-80904

What is CVE-2026-80904?

A vulnerability exists in the Linux kernel's TCP/IP stack related to improper handling of errors during asynchronous decryption operations in the TLS implementation. Specifically, the function tls_sw_splice_read() fails to check for errors in the async decryption context. This oversight enables a scenario where corrupted or unauthenticated records can continue to be delivered over a connection, bypassing safeguards present in related functions such as tls_sw_recvmsg() and tls_sw_read_sock(). As a result, this flaw could potentially lead to undetected transmission of erroneous packets, undermining the integrity and security of data exchanges.

References