Executive brief
The Linux kernel's TLS hardware offload feature contains a buffer overflow vulnerability in the tls_append_frag() function. An attacker with local access and the ability to use network splice operations can cause the kernel to write beyond allocated memory boundaries, leading to kernel panic, information disclosure, or privilege escalation on systems with TLS-capable network hardware.
Technical details
This is an out-of-bounds write vulnerability (CWE-787) in the Linux kernel's TLS device offload code path (net/tls/tls_device.c). The root cause is insufficient validation of fragment count bounds in tls_append_frag() when processing TLS records with MSG_MORE flag set during splice operations. When using TLS_TX_ZEROCOPY_RO with splice(SPLICE_F_MORE), small data chunks can bypass the record fullness check and cause num_frags to exceed MAX_SKB_FRAGS, leading to writes into adjacent kernel structures (destruct_work). The attack requires local code execution capability and a system with TLS offload hardware support (netdevsim or real NICs). The vulnerability results in kernel-level memory corruption that can be leveraged for arbitrary code execution in kernel context. A patch has been merged into the kernel that enforces record pushing to prevent fragment count overflow.
Affected products
- Linux Linux kernel 7.2.0-rc7 and prior with TLS device offload support
Timeline
- 2026-09-04: disclosed: CVE-2026-80852 published on NVD
- 2024: other: Vulnerability found with syzkaller fuzzer on netdevsim TLS offload emulation