CVE-2026-80852

A flaw was found in the Linux kernel's TLS device driver. A local attacker could exploit an out-of-bounds write vulnerability in the tls_append_frag() function when handling TLS_TX_ZEROCOPY_RO with splice(SPLICE_F_MORE) operations. This flaw allows an attacker to cause memory corruption, leading to a denial of service or potentially arbitrary code execution.

Red Hat has rated this vulnerability as Important because an unprivileged local attacker could corrupt kernel memory to cause a system crash or potentially achieve arbitrary code execution with kernel privileges. The affected code path resides in the TLS device driver, which is only executed when hardware TLS offload is supported and enabled on a network interface card, or under synthetic offload testing configurations. Consequently, standard deployments lacking specialized TLS-offload network hardware do not expose this attack surface under default operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the tls kernel module from being loaded if kernel TLS functionality is not needed in your environment.

1. Create a configuration file in /etc/modprobe.d/ to disable automatic loading of the module:

echo "install tls /bin/true" > /etc/modprobe.d/disable-tls.conf

2. Verify whether the module is currently loaded:

lsmod | grep tls

Warning: If the tls module is already loaded into the running kernel, a system restart is required for this configuration to take effect.

Caveats: Disabling the tls module will prevent applications from utilizing kernel-level TLS acceleration and hardware offloading features. Ensure workloads do not rely on in-kernel TLS before applying this configuration.