Executive brief
The Linux kernel's TLS (Transport Layer Security) implementation contains a logic error in the splice_read operation that allows authenticated data to be read from a connection after decryption fails. When async decryption fails, other read methods correctly abort, but splice_read bypasses these checks. This permits an attacker to extract potentially sensitive data or detect cryptographic failures that should terminate the connection.
Technical details
The vulnerability is a missing error-state check in the tls_sw_splice_read() function. When async decryption fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort() to store it in sk_err. However, tls_sw_splice_read() does not check async_wait.err before delivering records, unlike tls_sw_recvmsg() and tls_sw_read_sock(). The sk_err check in tls_rx_rec_wait() is skipped when a record is already parsed, and sock_error() clears sk_err after first access, while async_wait.err persists. This allows splice to continue delivering records on a connection that should be broken. The fix adds an async_wait.err check in tls_sw_splice_read() matching the other read paths. The vulnerability affects all Linux kernel versions with TLS splice support and requires a local network connection with a TLS socket using splice operations.
Affected products
- Linux Linux kernel all versions with net/tls splice support
Timeline
- 2026-09-04: disclosed
- 2026-08-06: patched: upstream commit 976df67f463db1fddaf2a32fb04f57ad2891a23d