CVE-2026-52974: Linux Kernel TLS Offload DoS Vulnerability

CVE-2026-52974 Overview

CVE-2026-52974 is a memory leak vulnerability in the Linux kernel's Transport Layer Security (TLS) subsystem. The flaw resides in the receive-side (RX) offload setup path within net/tls. When tls_set_device_offload_rx() fails at tls_dev_add(), the cleanup path does not release the anchor skb allocated by alloc_skb(0) in tls_strp_init(), leaking kernel memory on every failed offload attempt.

Critical Impact
Repeated failures of TLS RX offload setup can exhaust kernel memory, leading to denial of service on systems that rely on hardware-offloaded kernel TLS (kTLS).

Affected Products

Linux kernel versions containing commit 84c61fe1a75b ("tls: rx: do not use the standard strparser") prior to the fix
Kernel builds with CONFIG_TLS_DEVICE enabled for RX offload
Systems using network adapters that support kTLS RX offload

Discovery Timeline

2026-06-24 - CVE-2026-52974 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52974

Vulnerability Analysis

The Linux kernel TLS subsystem supports offloading TLS record processing to network hardware. During RX offload initialization, tls_set_device_offload_rx() first calls tls_set_sw_offload() to set up the software context, then attempts tls_dev_add() to register the offload with the device. If tls_dev_add() fails, the error path invokes tls_sw_free_resources_rx() to roll back the software context.

This cleanup function calls tls_sw_release_resources_rx(), which stops the strparser through tls_strp_stop(), and tls_sw_free_ctx_rx(), which frees the RX context. Neither releases the anchor socket buffer that tls_strp_init() allocated via alloc_skb(0). The skb remains orphaned in kernel memory each time offload registration fails.

Root Cause

The leak was introduced by commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), which replaced the standard strparser with a custom implementation that pre-allocates an anchor skb. The normal socket close path in tls_sk_proto_close() releases this skb through tls_sw_strparser_done(), which calls tls_strp_done(). The offload-failure path bypasses tls_strp_done() because tls_strp_done() invokes cancel_work_sync() and the strparser work handler acquires the socket lock that the failure path still holds.

Attack Vector

An attacker requires the ability to repeatedly trigger TLS RX offload setup on a socket while inducing tls_dev_add() failures. Each failed attempt leaks one anchor skb. Local users with CAP_NET_ADMIN or applications that configure kTLS on sockets bound to offload-capable NICs can drive this condition. Sustained exploitation degrades available kernel slab memory and can produce a denial of service.

The vulnerability is described in prose because no public exploit code exists. The patched commits referenced in the kernel stable tree detail the corrected cleanup sequence that releases the anchor skb on the failure path.

Detection Methods for CVE-2026-52974

Indicators of Compromise

Growth of the skbuff_head_cache or skbuff_fclone_cache slab caches without proportional growth in active sockets
Repeated kernel log entries from tls_set_device_offload_rx or tls_dev_add returning errors
Increasing tlsv2 or tlsv2_offload counters in /proc/net/tls_stat paired with offload setup failures
Steady decline in MemFree reported by /proc/meminfo on long-running hosts using kTLS RX offload

Detection Strategies

Monitor slab allocator metrics via slabtop and /proc/slabinfo for unexpected growth in skb caches on hosts running kTLS workloads
Correlate kernel error messages from the TLS device offload path with application-level TLS configuration failures
Audit kernel versions against the fixed commits listed in the kernel stable tree to identify exposed hosts

Monitoring Recommendations

Track kernel memory consumption trends on hosts that enable CONFIG_TLS_DEVICE and use NICs supporting TLS RX offload
Alert on repeated setsockopt(TCP_ULP, "tls") failures from the same process or service account
Capture dmesg output continuously and forward to a centralized log store for retrospective analysis of TLS subsystem warnings

How to Mitigate CVE-2026-52974

Immediate Actions Required

Apply the upstream kernel patches referenced under commits 0c9f399b37ce, 3c405dfa9619, 58689498ca33, 688f12aa4451, 9c54e76f8d6e, and bd07fe6c38b9 from the kernel.org stable tree
Update to a distribution kernel that incorporates the fix for the strparser anchor skb leak
Inventory hosts using kTLS RX offload and prioritize patching those exposed to untrusted local users

Patch Information

The fix ensures the anchor skb allocated in tls_strp_init() is released on the offload setup failure path. Six commits in the Linux kernel stable tree backport the correction across maintained branches. Review the linked commits in the Linux kernel git repository and apply the version matching your kernel branch.

Workarounds

Disable TLS RX hardware offload on affected hosts by avoiding setsockopt(SOL_TLS, TLS_RX, ...) configurations on offload-capable NICs until patches are applied
Restrict CAP_NET_ADMIN and the ability to configure kTLS to trusted service accounts
Reboot long-running hosts periodically to reclaim leaked memory until a patched kernel is deployed

bash

# Verify whether the running kernel includes the fix
uname -r
grep -r "tls_strp_init" /usr/src/linux-$(uname -r)/net/tls/ 2>/dev/null
# Check for TLS device offload usage
cat /proc/net/tls_stat 2>/dev/null
ethtool -k <iface> | grep -i tls