---
id: CVE-2026-80904
title: 'net/tls: Fail tls_sw_splice_read() after a failed async decrypt'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/tls: Fail tls_sw_splice_read() after a failed async decrypt

  When an async decrypt fails, tls_decrypt_done() records the error in
  ctx->async_wait.err and calls tls_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    a808aadff634c7a408b2ab84d5919e9a741fdb5b
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    06c2a53604fa1dc4820063828d7dadb3675b7af8
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    18ae1e95f20867106a28820c208a9cec99dda861
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    82d9269f01ebfd835b6256aa17016a974cbbc647
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    4b177911eb9f799e9841c2f87c75b08cb112757a
  - >-
    Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a <
    976df67f463db1fddaf2a32fb04f57ad2891a23d
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:04:58.692495Z'
published: '2026-09-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:56.646Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80904'
references:
  - url: 'https://git.kernel.org/stable/c/a808aadff634c7a408b2ab84d5919e9a741fdb5b'
  - url: 'https://git.kernel.org/stable/c/06c2a53604fa1dc4820063828d7dadb3675b7af8'
  - url: 'https://git.kernel.org/stable/c/18ae1e95f20867106a28820c208a9cec99dda861'
  - url: 'https://git.kernel.org/stable/c/82d9269f01ebfd835b6256aa17016a974cbbc647'
  - url: 'https://git.kernel.org/stable/c/4b177911eb9f799e9841c2f87c75b08cb112757a'
  - url: 'https://git.kernel.org/stable/c/976df67f463db1fddaf2a32fb04f57ad2891a23d'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.0529
ingestedAt: '2026-11-06T18:00:12.527Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fail tls_sw_splice_read() after a failed async decrypt

When an async decrypt fails, tls_decrypt_done() records the error in
ctx->async_wait.err and calls tls_err_abort(), which stores it in
sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
async_wait.err once they hold the reader lock and fail the call: a
record that did not authenticate breaks the connection.

tls_sw_splice_read() has no such check, and sk_err does not stand in
for one. tls_rx_rec_wait() tests sk_err only inside the loop it
skips whenever a record is already parsed, and the first reader to
reach sock_error() clears it, while async_wait.err persists. A
splice therefore keeps delivering records on a connection that
recvmsg() and read_sock() refuse to read.

Read async_wait.err in tls_sw_splice_read() as the other two readers
do.

## Affected

- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < a808aadff634c7a408b2ab84d5919e9a741fdb5b`
- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < 06c2a53604fa1dc4820063828d7dadb3675b7af8`
- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < 18ae1e95f20867106a28820c208a9cec99dda861`
- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < 82d9269f01ebfd835b6256aa17016a974cbbc647`
- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < 4b177911eb9f799e9841c2f87c75b08cb112757a`
- `Linux >= f314bfee81b1bf8e01168177b2f65f24eb8da63a < 976df67f463db1fddaf2a32fb04f57ad2891a23d`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.