{"id":"CVE-2026-80904","summary":"net/tls: Fail tls_sw_splice_read() after a failed async decrypt","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fail tls_sw_splice_read() after a failed async decrypt\n\nWhen an async decrypt fails, tls_decrypt_done() records the error in\nctx-\u003easync_wait.err and calls tls_err_abort(), which stores it in\nsk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read\nasync_wait.err once they hold the reader lock and fail the call: a\nrecord that did not authenticate breaks the connection.\n\ntls_sw_splice_read() has no such check, and sk_err does not stand in\nfor one. tls_rx_rec_wait() tests sk_err only inside the loop it\nskips whenever a record is already parsed, and the first reader to\nreach sock_error() clears it, while async_wait.err persists. A\nsplice therefore keeps delivering records on a connection that\nrecvmsg() and read_sock() refuse to read.\n\nRead async_wait.err in tls_sw_splice_read() as the other two readers\ndo.","modified":"2026-09-06T03:46:55.861807371Z","published":"2026-09-04T17:19:14.391Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80904.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647"},{"type":"WEB","url":"https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80904.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80904"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f314bfee81b1bf8e01168177b2f65f24eb8da63a"},{"fixed":"a808aadff634c7a408b2ab84d5919e9a741fdb5b"},{"fixed":"06c2a53604fa1dc4820063828d7dadb3675b7af8"},{"fixed":"18ae1e95f20867106a28820c208a9cec99dda861"},{"fixed":"82d9269f01ebfd835b6256aa17016a974cbbc647"},{"fixed":"4b177911eb9f799e9841c2f87c75b08cb112757a"},{"fixed":"976df67f463db1fddaf2a32fb04f57ad2891a23d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80904.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.19.0"},{"fixed":"6.1.184"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.153"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.105"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.46"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80904.json"}}],"schema_version":"1.9.0"}