CVE-2026-74610: Linux 6.5

Affected technology

Linux · fe1e81d4f73b6cbaed4fcc476960d26770642842 to before aa8b14647721b5a4958712b35cf43e3125d47753, fe1e81d4f73b6cbaed4fcc476960d26770642842 to before f634289a0b557a197c5f37284b623cefedfe73d5, fe1e81d4f73b6cbaed4fcc476960d26770642842 to before 3fc5044796dd87b8d68be4207046f5ce2748174c, fe1e81d4f73b6cbaed4fcc476960d26770642842 to before 3c5f8f2aa57c647b83add4896aab64aac5fdedad, fe1e81d4f73b6cbaed4fcc476960d26770642842 to before 7bca91d63341274e857f4aeaad54d229405e93dc
Linux

Linux · 6.5
Linux

Component: Not specified by the source
File: net/tls/tls_sw.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

An unprivileged user can trigger this on a loopback TCP socket with the "tls" ULP attached: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0 Call Trace: skcipher_walk_next+0x1d1/0x2c0 gcm_encrypt_aesni_avx+0x1e9/0x220 bpf_exec_tx_verdict+0x3bb/0x860 tls_sw_sendmsg+0xa1a/0xca0 __sys_sendto+0x1da/0x1f0 Set full_record in the copy path when the ring becomes full, and push a record that is already full on entry to the sendmsg loop. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.