Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg()… (CVE-2026-74611)

The Linux kernel TLS receive code advanced the message iterator when mapping user pages for the TLS 1.3 optimistic zero-copy path in tls_decrypt_sg(). If the decrypted record was not unpadded application data, tls_decrypt_sw() retried decryption into a kernel skb but left the iterator advanced. This caused subsequent copies from the skb to overwrite decrypted bytes at later points in the caller's iovecs beyond the length reported by recvmsg(). A TLS peer could exploit this when TLS_RX_EXPECT_NO_PAD was enabled. The fix reverts the iterator by the number of bytes consumed before retrying without zero-copy and includes a self-test to verify correct behavior.

This vulnerability allows a TLS peer to cause memory corruption in the kernel's TLS receive path, potentially leading to data integrity issues or denial of service. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel to address this vulnerability by restoring the message iterator correctly before retrying decryption without zero-copy. Users should apply the official kernel updates that include this patch. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are specified.