CVE-2026-74610

A flaw was found in the Linux kernel's Transport Layer Security (TLS) implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol (ULP) attached. This vulnerability occurs because the TLS software send message function does not correctly handle a full plaintext message ring, leading to memory corruption and a system crash, resulting in a Denial of Service (DoS).

A local user can trigger a NULL pointer dereference in the TLS software send path because a full plaintext sk_msg ring may be left unpushed after sendmsg() copy processing. A later splice() can append data to the already full ring, causing sg.end to wrap to sg.start, live scatterlist entries to be overwritten, and sg.size to no longer match the reachable ring contents. When the record is pushed, scatterwalk can run past the valid scatterlist and crash the kernel in the crypto path. For the CVSS the PR:L value is used because triggering requires local code execution by an unprivileged user with access to a TCP socket using the tls ULP, not administrative privileges. The issue is not directly network reachable because the attacker must run local code on the target, although loopback sockets are sufficient. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.