CVE-2026-74610: Linux Kernel TLS Privilege Escalation Flaw

CVE-2026-74610 Overview

CVE-2026-74610 is a Linux kernel vulnerability in the Transport Layer Security (TLS) software implementation (tls_sw). The flaw resides in tls_sw_sendmsg_locked(), where the copy path fails to mark a record as full when it exhausts the plaintext sk_msg scatterlist ring. A subsequent splice() call operates on the seemingly empty ring, causing sg.end to wrap past sg.start and overwrite live scatterlist entries. Pushing the record then runs the scatterwalk beyond the end of the scatterlist, producing a NULL pointer dereference in memcpy_from_scatterwalk during AES-GCM encryption.

Critical Impact
An unprivileged local user can trigger kernel memory corruption and denial of service by attaching the tls Upper Layer Protocol (ULP) to a loopback TCP socket.

Affected Products

Linux kernel versions containing the affected net/tls software implementation prior to the referenced stable patches
Systems with the tls ULP available to unprivileged users on TCP sockets
Distributions shipping kernels that predate commits 3c5f8f2, 3fc5044, 7bca91d, aa8b146, and f634289

Discovery Timeline

2026-08-22 - CVE-2026-74610 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74610

Vulnerability Analysis

The defect lives in the kernel TLS transmit path in net/tls/tls_sw.c. The tls_sw_sendmsg_locked() function maintains a plaintext scatter-gather message ring (sk_msg) that accumulates fragments before they are encrypted and pushed to the underlying TCP socket. When the copy path adds a fragment that exactly fills the ring, the code neglects to set the full_record flag. The record therefore stays resident and unpushed while remaining structurally full.

A later splice() invocation enters sk_msg_page_add(), which performs no fullness check. The scatterlist end index sg.end wraps back to sg.start, making the ring appear empty. Additional fragments overwrite entries that still describe live pages, and sg.size diverges from the range actually reachable between sg.start and sg.end. When encryption begins, skcipher_walk_next() and memcpy_from_scatterwalk() follow the corrupted scatterlist off the end of the array, dereferencing invalid memory.

Root Cause

The root cause is a missing state transition in the copy path of tls_sw_sendmsg_locked(). Failing to set full_record when the ring becomes full breaks the invariant that a full ring cannot receive additional entries, and sk_msg_page_add() does not defend against this externally.

Attack Vector

An unprivileged local user attaches the tls ULP to a TCP socket, typically over loopback, then interleaves sendmsg() copy operations with splice() calls sized to trigger the wrap. The result is a kernel NULL pointer dereference in memcpy_from_scatterwalk+0x32/0xc0 reached through gcm_encrypt_aesni_avx, bpf_exec_tx_verdict, tls_sw_sendmsg, and __sys_sendto. Memory corruption of adjacent scatterlist state precedes the crash, creating a potential primitive for further exploitation.

No public proof-of-concept exploit or verified code sample is available at publication. See the upstream references for the patch-level fix.

Detection Methods for CVE-2026-74610

Indicators of Compromise

Kernel oops or panic messages referencing memcpy_from_scatterwalk, skcipher_walk_next, or gcm_encrypt_aesni_avx in the call trace
NULL pointer dereference entries in dmesg originating from tls_sw_sendmsg and __sys_sendto
Unexpected termination of processes using kernel TLS on loopback or local TCP sockets

Detection Strategies

Audit kernel logs (journalctl -k, /var/log/kern.log) for the signature stack trace involving tls_sw_sendmsg and memcpy_from_scatterwalk
Inventory hosts where unprivileged users can attach the tls ULP by checking CONFIG_TLS=y and module load state via lsmod | grep '^tls '
Track running kernel versions against the fixed stable trees referenced by commits 3c5f8f2, 3fc5044, 7bca91d, aa8b146, and f634289

Monitoring Recommendations

Alert on repeated kernel crashes on the same host, which may indicate exploitation attempts against net/tls
Monitor process creation and syscall telemetry for unusual setsockopt(TCP_ULP, "tls") usage from unprivileged accounts on multi-tenant systems
Correlate kernel BUG signatures with EDR endpoint telemetry to surface local privilege escalation attempts

How to Mitigate CVE-2026-74610

Immediate Actions Required

Apply the latest stable kernel update from your distribution that incorporates commits 3c5f8f2aa57c, 3fc5044796dd, 7bca91d63341, aa8b14647721, or f634289a0b55
Reboot affected hosts after patching to ensure the corrected tls_sw_sendmsg_locked() code path is loaded
Prioritize multi-tenant systems, container hosts, and shared build infrastructure where unprivileged local users are present

Patch Information

The fix sets full_record in the copy path when the ring becomes full and pushes any record that is already full on entry to the sendmsg loop. Patches are available in the upstream stable tree: Kernel Patch Commit 3c5f8f2, Kernel Patch Commit 3fc5044, Kernel Patch Commit 7bca91d, Kernel Patch Commit aa8b146, and Kernel Patch Commit f634289.

Workarounds

Blacklist the tls kernel module on systems that do not require kernel TLS offload until patching is possible
Restrict which users can create sockets that call setsockopt(TCP_ULP, "tls") using seccomp or Linux Security Module policies
Where feasible, migrate TLS termination to userspace libraries so the kernel tls_sw path is not exposed to untrusted local users

bash

# Configuration example: prevent unprivileged loading and use of the tls ULP module
echo 'install tls /bin/true' | sudo tee /etc/modprobe.d/disable-tls-ulp.conf
sudo rmmod tls 2>/dev/null || true
# Verify the module is no longer loaded
lsmod | grep '^tls '