CVE-2026-23414

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tls: Purge async_hold in tls_decrypt_async_wait()

The async_hold queue pins encrypted input skbs while

the AEAD engine references their scatterlist data. Once

tls_decrypt_async_wait() returns, every AEAD operation

has completed and the engine no longer references those

skbs, so they can be freed unconditionally.

A subsequent patch adds batch async decryption to

tls_sw_read_sock(), introducing a new call site that

must drain pending AEAD operations and release held

skbs. Move __skb_queue_purge(&ctx->async_hold) into

tls_decrypt_async_wait() so the purge is centralized

and every caller -- recvmsg's drain path, the -EBUSY

fallback in tls_do_decryption(), and the new read_sock

batch path -- releases held skbs on synchronization

without each site managing the purge independently.

This fixes a leak when tls_strp_msg_hold() fails part-way through,

after having added some cloned skbs to the async_hold

queue. tls_decrypt_sg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References