In the Linux kernel, the following vulnerability has been resolved:
tls: Purge async_hold in tls_decrypt_async_wait()
The async_hold queue pins encrypted input skbs while
the AEAD engine references their scatterlist data. Once
tls_decrypt_async_wait() returns, every AEAD operation
has completed and the engine no longer references those
skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to
tls_sw_read_sock(), introducing a new call site that
must drain pending AEAD operations and release held
skbs. Move __skb_queue_purge(&ctx->async_hold) into
tls_decrypt_async_wait() so the purge is centralized
and every caller -- recvmsg's drain path, the -EBUSY
fallback in tls_do_decryption(), and the new read_sock
batch path -- releases held skbs on synchronization
without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through,
after having added some cloned skbs to the async_hold
queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to
process all pending decrypts, and drop back to synchronous mode, but
tls_sw_recvmsg() only flushes the async_hold queue when one record has
been processed in "fully-async" mode, which may not be the case here.
[pabeni@redhat.com: added leak comment]
References
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
24 Apr 2026, 15:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-401 | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/2dcf324855c34e7f934ce978aa19b645a8f3ee71 - Patch | |
| References | () https://git.kernel.org/stable/c/6dc11e0bd0a5466bcc76d275c09e5537bd0597dd - Patch | |
| References | () https://git.kernel.org/stable/c/84a8335d8300576f1b377ae24abca1d9f197807f - Patch | |
| References | () https://git.kernel.org/stable/c/9f557c7eae127b44d2e863917dc986a4b6cb1269 - Patch | |
| References | () https://git.kernel.org/stable/c/ac435be7c7613eb13a5a8ceb5182e10b50c9ce87 - Patch | |
| References | () https://git.kernel.org/stable/c/fd8037e1f18ca5336934d0e0e7e1a4fe097e749d - Patch | |
| First Time |
Linux
Linux linux Kernel |
11 Apr 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 12:16
Updated : 2026-04-27 14:16
NVD link : CVE-2026-23414
Mitre link : CVE-2026-23414
CVE.ORG link : CVE-2026-23414
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime