The Linux kernel TLS subsystem had a vulnerability where the async_hold queue, which pins encrypted input socket buffers (skbs) during asynchronous AEAD cryptographic operations, was not always properly purged in tls_decrypt_async_wait(). This caused a resource leak when tls_strp_msg_hold() failed after adding cloned skbs to the async_hold queue. The fix moves the skb queue purge into tls_decrypt_async_wait(), centralizing cleanup and ensuring all callers release held skbs on synchronization. This addresses leaks introduced by new batch async decryption paths and fallback mechanisms. The vulnerability affects Linux kernel versions prior to 6.8.x as specified. The issue is resolved by applying the official patches distributed by Ubuntu and other vendors.

The vulnerability causes a resource leak in the Linux kernel TLS subsystem, which can degrade system stability or performance due to unreleased socket buffers. There is no direct confidentiality or integrity impact reported. The CVSS vector indicates no confidentiality or integrity loss but an availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No known exploits are in the wild. The issue could be triggered by local or remote TLS traffic processing but does not escalate privileges or disclose sensitive data.

An official patch is available and should be applied promptly via standard Linux kernel updates provided by the vendor. For Ubuntu users, update to the fixed kernel versions as per Ubuntu Security Notices USN-8567-1 and USN-8574-1. After updating, a system reboot is required to activate the patched kernel. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. No additional mitigations are required beyond applying the official fix.