Junglewise Threat Intelligence

CVE-2026-23414: Linux Kernel memory leak in TLS asynchronous decryption

CVE-2026-23414 · Severity: high · CVSS 7.5 · Published 2026-04-02

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A memory leak vulnerability was identified in the Linux kernel's Transport Layer Security (TLS) implementation. This component is responsible for encrypting and decrypting secure network communications. An attacker could potentially exploit this flaw to cause a denial-of-service condition by exhausting system memory, impacting the availability of the affected system and its network services.

Technical details

A memory leak exists in the Linux kernel TLS implementation (net/tls/tls_sw.c) due to improper management of the async_hold queue. The async_hold queue pins encrypted input socket buffers (skbs) while the AEAD engine processes them; however, certain failure paths in tls_strp_msg_hold() or transitions back to synchronous mode failed to purge this queue. This results in cloned skbs being leaked rather than freed. The fix centralizes the call to __skb_queue_purge() within tls_decrypt_async_wait() to ensure all callers, including recvmsg and the read_sock batch path, release held buffers upon synchronization. Exploitation can lead to kernel memory exhaustion (CWE-401).

Affected products

  • Linux Linux Kernel Fixed in 6.1.x, 6.6.x, 6.8.x, 6.12.x, 6.13.x
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-03-24: disclosed: Initial patch submission by Chuck Lever
  • 2026-04-02: advisory: CVE published and patches integrated into stable trees
  • 2026-07-14: other: Siemens industrial products confirmed affected

References

Related threats