CVE-2026-72330

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Consume empty data records in tls_sw_read_sock()

A peer may send a zero-length TLS application_data record; TLS 1.3

explicitly permits these as a traffic-analysis countermeasure (RFC

8446, Section 5.1). After decryption such a record has full_len ==

0. tls_sw_read_sock() hands it to the read_actor, which has no

payload to consume and returns zero. The loop treats a zero return

as backpressure (used <= 0), requeues the skb at the head of

rx_list, and stops. rx_list is serviced head-first on the next

call, so the empty record is dequeued, fails the same way, and is

requeued again; every later record on the connection is blocked

behind it.

tls_sw_recvmsg() does not stall on this: a zero-length data record

copies nothing and falls through to consume_skb(). Mirror that in

the read_sock() path by recognizing an empty data record before

the actor runs, consuming it, and continuing.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References