https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:28:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80904 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/tls: Fail tls_sw_splice_read() after a failed async decrypt</p> <p>When an async decrypt fails, tls_decrypt_done() records the error in ctx-&gt;async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.</p> <p>tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read.</p> <p>Read async_wait.err in tls_sw_splice_read() as the other two readers do.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/tls: Fail tls_sw_splice_read() after a failed async decrypt</p> <p>When an async decrypt fails, tls_decrypt_done() records the error in ctx-&gt;async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.</p> <p>tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read.</p> <p>Read async_wait.err in tls_sw_splice_read() as the other two readers do.</p> https://vulnerability.circl.lu/vuln/cve-2026-80904