CVE-2026-31533

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

The -EBUSY handling in tls_do_encryption(), introduced by commit

859054147318 ("net: tls: handle backlogging of crypto requests"), has

a use-after-free due to double cleanup of encrypt_pending and the

scatterlist entry.

When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to

the cryptd backlog and the async callback tls_encrypt_done() will be

invoked upon completion. That callback unconditionally restores the

scatterlist entry (sge->offset, sge->length) and decrements

ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an

error, the synchronous error path in tls_do_encryption() performs the

same cleanup again, double-decrementing encrypt_pending and

double-restoring the scatterlist.

The double-decrement corrupts the encrypt_pending sentinel (initialized

to 1), making tls_encrypt_async_wait() permanently skip the wait

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References