CVE-2026-23414

A flaw was found in the Linux kernel's Transport Layer Security (TLS) subsystem. When processing TLS messages, a memory leak can occur if the tls_strp_msg_hold() function fails. This failure can lead to socket kernel buffers (skbs) being added to an internal queue but not properly released, consuming system memory. This issue could potentially lead to a Denial of Service (DoS) condition.

The leak occurs when async decryption holds skbs on async_hold but the synchronous fallback path does not purge them after tls_decrypt_async_wait() completes. Affected systems use kTLS (TLS offload in the kernel) on sockets. Impact is resource exhaustion and possible denial of service rather than confidentiality or integrity loss.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.