CVE-2026-64047

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

When an sk_msg scatterlist ring wraps (sg.end < sg.start),

tls_push_record() chains the tail portion of the ring to the head

using sg_chain(). An extra entry in the sg array is reserved for

this:

struct sk_msg_sg {

[...]

/* The extra two elements:

* 1) used for chaining the front and sections when the list becomes

* partitioned (e.g. end < start). The crypto APIs require the

* chaining;

* 2) to chain tailer SG entries after the message.

*/

struct scatterlist data[MAX_MSG_FRAGS + 2];

The current code uses MAX_SKB_FRAGS + 1 as the ring size:

sg_chain(&msg_pl->sg.data[msg_pl->sg.start],

MAX_SKB_FRAGS - msg_pl->sg.start + 1,

msg_pl->sg.data);

This places the chain pointer at

sg_chain(data[start], (MAX_SKB_FRAGS - msg_start +

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References