Executive brief
A vulnerability exists in the Linux kernel's Transport Layer Security (TLS) implementation. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized code by exploiting how the system handles encrypted data decryption. The issue specifically affects systems using certain cryptographic configurations, potentially impacting the stability and security of encrypted network communications.
Technical details
A use-after-free (UAF) vulnerability exists in net/tls/tls_sw.c within the Linux kernel's TLS subsystem. The root cause is the shared use of the async_wait completion structure between asynchronous and synchronous decryption paths, which can lead to race conditions during socket closure or decryption completion. An attacker with local access can trigger this race condition, especially on systems using cryptd without AVX support, to cause memory corruption. The fix separates the handling of non-async decryption requests by using a local crypto_wait structure, ensuring that synchronous operations do not rely on the shared context's reference counting or wait queues. Patches have been released for various stable kernel branches including 6.1.y, 6.6.y, and 6.7.y.
Affected products
- Linux Linux Kernel 4.13 to 6.1.149, 6.2 to 6.6.21, 6.7 to 6.7.9, 6.8-rc1 to 6.8-rc6
Timeline
- 2024-02-28: other: Initial patch authored
- 2025-08-28: advisory: NVD Published Date
References
- https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011
- https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5
- https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186
- https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html