CVE-2026-64047 Overview
CVE-2026-64047 is an off-by-one flaw in the Linux kernel TLS (Transport Layer Security) subsystem. The bug lives in tls_push_record() inside net/tls, which chains a wrapped sk_msg scatterlist ring using sg_chain(). The chain pointer is written to data[MAX_SKB_FRAGS] instead of the reserved trailing entry, corrupting the scatterlist layout when the ring wraps (sg.end < sg.start). Because kernel TLS processes data from any authenticated network peer, exploitation targets network-reachable workloads that offload TLS to the kernel.
Critical Impact
A remote attacker can trigger scatterlist corruption in the kernel TLS path, leading to memory corruption, denial of service, or potential code execution in kernel context.
Affected Products
- Linux kernel net/tls subsystem on versions preceding the fix commits
- Distributions shipping kernel TLS (kTLS) with the affected tls_push_record() implementation
- Workloads using sk_msg-based BPF sockmap alongside kTLS
Discovery Timeline
- 2026-07-19 - CVE-2026-64047 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64047
Vulnerability Analysis
The Linux kernel TLS layer stores payload fragments in an sk_msg scatterlist ring declared as struct scatterlist data[MAX_MSG_FRAGS + 2]. The two extra entries reserve space for chaining the tail of a wrapped ring back to the head and for appending trailer entries required by the crypto APIs.
When sg.end < sg.start, tls_push_record() calls sg_chain() with an entry count of MAX_SKB_FRAGS - msg_pl->sg.start + 1. That arithmetic places the chain pointer at data[MAX_SKB_FRAGS] rather than the true last slot in the array. The result is an off-by-one that writes the chain descriptor into a scatterlist entry still considered a data slot, misaligning the crypto scatter-gather walk that follows.
The upstream fix converts the size argument to ARRAY_SIZE(msg_pl->sg.data) - msg_pl->sg.start (dropping the - start where redundant) so the chain pointer lands on the reserved trailing entry.
Root Cause
The root cause is incorrect index arithmetic in sg_chain() invocation. The code used MAX_SKB_FRAGS + 1 as the ring size while the underlying array is sized MAX_MSG_FRAGS + 2. The mismatch stems from a merge race with commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down"), which grew the array without updating the chain math in TLS.
Attack Vector
Exploitation requires triggering a wrapped sk_msg scatterlist ring during a kTLS record transmission. An attacker who can influence fragmentation patterns of an established TLS session—by controlling send sizes, sockmap redirection, or BPF ingress queue behavior—can force sg.end < sg.start and cause tls_push_record() to overwrite an in-use scatterlist entry with a chain pointer. Downstream crypto operations then dereference the malformed entry.
No public proof-of-concept is available. See the upstream fix commits for exact code paths, including Linux Kernel Commit 285943c6 and Linux Kernel Commit 47110c3a.
Detection Methods for CVE-2026-64047
Indicators of Compromise
- Kernel oops or panic messages referencing tls_push_record, sg_chain, or scatterwalk_* functions
- Unexpected crypto API failures (-EINVAL, -EFAULT) on kTLS sockets under load
- Sudden termination of TLS-offloaded services after BPF sockmap or psock churn
Detection Strategies
- Audit running kernel versions against the fix commits listed under external references and flag hosts without the patch applied
- Correlate dmesg crashes in net/tls with active BPF sockmap programs to identify triggering workloads
- Monitor sockmap and kTLS telemetry for abnormal fragmentation patterns that would push sk_msg rings into the wrapped state
Monitoring Recommendations
- Ship kernel logs to a centralized platform and alert on stack traces referencing tls_sw.c or sg_chain
- Track TLS handshake failures and mid-session resets on kTLS-enabled services as a soft indicator of instability
- Baseline sockmap load and TLS record sizes to identify anomalous senders potentially probing the boundary condition
How to Mitigate CVE-2026-64047
Immediate Actions Required
- Inventory Linux hosts running kernel TLS (tls_sw) and BPF sockmap programs, prioritizing internet-facing systems
- Apply the stable kernel updates that include the sg_chainARRAY_SIZE conversion
- Reboot patched systems to activate the corrected kernel binary
Patch Information
The fix is available in the upstream stable trees via the commits published on kernel.org, including Linux Kernel Commit 131ef120, Linux Kernel Commit 66339b71, Linux Kernel Commit 73963a3, Linux Kernel Commit 84158c29, Linux Kernel Commit 2fb0dc7e, and Linux Kernel Commit eca989ea. Pull the corresponding distribution kernel packages once released.
Workarounds
- Disable kernel TLS offload where feasible and terminate TLS in userspace until patched
- Remove or restrict BPF sockmap programs that redirect into kTLS sockets to reduce the chance of triggering wrapped sk_msg rings
- Limit local privileges to load BPF programs by tightening CAP_BPF and CAP_NET_ADMIN assignments
# Verify running kernel and check for the fix
uname -r
# Confirm patch commit is present in your distribution's changelog
rpm -q --changelog kernel | grep -E '131ef120|285943c6|47110c3a' || \
dpkg-query -W -f='${Version}\n' linux-image-$(uname -r)
# Temporary hardening: restrict BPF program loading to root
sysctl -w kernel.unprivileged_bpf_disabled=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
