VulnerabilityPublished 4 Sep 2026Updated 6 Nov 2026

CVE-2026-80904: Linux kernel · net/tls: Fail tls_sw_splice_read() after a failed async decrypt

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in a808aadff634c7a408b2ab84d5919e9a741fdb5b : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in a808aadff634c7a408b2ab84d5919e9a741fdb5b, 976df67f463db1fddaf2a32fb04f57ad2891a23d, 82d9269f01ebfd835b6256aa17016a974cbbc647 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < a808aadff634c7a408b2ab84d5919e9a741fdb5b	Fixed in a808aadff634c7a408b2ab84d5919e9a741fdb5b
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < 976df67f463db1fddaf2a32fb04f57ad2891a23d	Fixed in 976df67f463db1fddaf2a32fb04f57ad2891a23d
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < 82d9269f01ebfd835b6256aa17016a974cbbc647	Fixed in 82d9269f01ebfd835b6256aa17016a974cbbc647
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < 18ae1e95f20867106a28820c208a9cec99dda861	Fixed in 18ae1e95f20867106a28820c208a9cec99dda861
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < 06c2a53604fa1dc4820063828d7dadb3675b7af8	Fixed in 06c2a53604fa1dc4820063828d7dadb3675b7af8
LinuxLinux	Affected ≥ f314bfee81b1bf8e01168177b2f65f24eb8da63a, < 4b177911eb9f799e9841c2f87c75b08cb112757a	Fixed in 4b177911eb9f799e9841c2f87c75b08cb112757a

AI-suggested

A fix is available and has been applied in the Linux kernel after version 5.19, as indicated by the fixed commit hashes. Users should update to a kernel version including these fixes to resolve the issue. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's TLS implementation (version 5.19) allows tls_sw_splice_read() to continue delivering records on a connection even after an asynchronous decryption failure. This occurs because tls_sw_splice_read() does not check the async decryption error state that other TLS read functions do, potentially breaking the expected connection error handling.

Impact

The vulnerability causes tls_sw_splice_read() to ignore asynchronous decryption errors, allowing delivery of potentially unauthenticated or corrupted TLS records on a connection that other TLS read functions would reject. This breaks the expected error handling and could lead to inconsistent or insecure TLS connection states. There is no indication of active exploitation or public exploit code.

Summary

In Linux kernel version 5.19, the TLS subsystem has a flaw where the function tls_sw_splice_read() does not properly check for errors after an asynchronous decrypt failure. While tls_decrypt_done() records errors and other read functions (tls_sw_recvmsg() and tls_sw_read_sock()) respect these errors and fail accordingly, tls_sw_splice_read() lacks this check. This results in the splice operation continuing to deliver records on a connection that should have been broken due to a failed authentication record. The issue is fixed in subsequent commits identified by multiple fixed version hashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:33 UTC

Technical details

References

Community reviews

Related threats