CVE-2026-52974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix strparser anchor skb leak on offload RX setup failure

When tls_set_device_offload_rx() fails at tls_dev_add(), the error path

calls tls_sw_free_resources_rx() to clean up the SW context that was

initialized by tls_set_sw_offload(). This function calls

tls_sw_release_resources_rx() (which stops the strparser via

tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),

but never frees the anchor skb that was allocated by alloc_skb(0) in

tls_strp_init().

Note that tls_sw_free_resources_rx() is exclusively used for this

"failed to start offload" code path, there's no other caller.

The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use

the standard strparser"), because the standard strparser doesn't try

to pre-allocate an skb.

The normal close path in tls_sk_proto_close() handles cleanup by calling

tls_sw_strparser_done() (which calls tls_strp_done()) after dropping

the socke

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References