CVE-2026-80904 is a vulnerability in Linux Kernel
Published on September 4, 2026
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
In the Linux kernel, the following vulnerability has been resolved:
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
When an async decrypt fails, tls_decrypt_done() records the error in
ctx->async_wait.err and calls tls_err_abort(), which stores it in
sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
async_wait.err once they hold the reader lock and fail the call: a
record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in
for one. tls_rx_rec_wait() tests sk_err only inside the loop it
skips whenever a record is already parsed, and the first reader to
reach sock_error() clears it, while async_wait.err persists. A
splice therefore keeps delivering records on a connection that
recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers
do.
Products Associated with CVE-2026-80904
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below a808aadff634c7a408b2ab84d5919e9a741fdb5b is affected.
- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below 06c2a53604fa1dc4820063828d7dadb3675b7af8 is affected.
- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below 18ae1e95f20867106a28820c208a9cec99dda861 is affected.
- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below 82d9269f01ebfd835b6256aa17016a974cbbc647 is affected.
- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below 4b177911eb9f799e9841c2f87c75b08cb112757a is affected.
- Version f314bfee81b1bf8e01168177b2f65f24eb8da63a and below 976df67f463db1fddaf2a32fb04f57ad2891a23d is affected.
- Version 5.19 is affected.
- Before 5.19 is unaffected.
- Version 6.1.184, <= 6.1.* is unaffected.
- Version 6.6.153, <= 6.6.* is unaffected.
- Version 6.12.105, <= 6.12.* is unaffected.
- Version 6.18.46, <= 6.18.* is unaffected.
- Version 7.1.10, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.