Executive brief
A memory leak was identified in the Linux kernel's TLS (Transport Layer Security) implementation. When the system fails to set up hardware-accelerated encryption for network traffic, it fails to properly release a small amount of memory. Over time, repeated setup failures could lead to increased memory consumption, potentially impacting system performance or stability.
Technical details
A memory leak exists in net/tls due to an unreleased anchor skb (socket buffer) during error handling. When tls_set_device_offload_rx() fails at tls_dev_add(), the error path invokes tls_sw_free_resources_rx(). While this function cleans up the software context, it fails to free the anchor skb allocated by alloc_skb(0) in tls_strp_init(). This issue was introduced in commit 84c61fe1a75b when the kernel moved away from the standard strparser. The fix introduces __tls_strp_done() to ensure the anchor skb is freed during these specific failure paths.
Affected products
- Linux Linux Kernel 6.0 to 6.9.x
Timeline
- 2026-04-28: disclosed: Initial patch submitted by Jakub Kicinski
- 2026-04-30: patched: Patch merged into mainline kernel
- 2026-06-24: advisory: CVE-2026-52974 published
References
- https://git.kernel.org/stable/c/0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32
- https://git.kernel.org/stable/c/3c405dfa9619e506e75b8e41f8b29a5b99731877
- https://git.kernel.org/stable/c/58689498ca3384851145a754dbb1d8ed1cf9fb54
- https://git.kernel.org/stable/c/688f12aa44511dd57e448eb670075c6302ad1dc1
- https://git.kernel.org/stable/c/9c54e76f8d6eb11735918777ef0e0509e089557d
- https://git.kernel.org/stable/c/bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc