When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain,… (CVE-2026-49423)

The vulnerability in ktls_ocf_tls_cbc_decrypt() arises from improper handling of the iovec array when processing TLS 1.2 CBC records. Specifically, the function increments the iovec index for every mbuf in the chain, even those skipped because they only contain TLS header bytes, resulting in uninitialized entries in the iovec array. Since the iovec array is allocated without zeroing, a remote TLS peer can trigger the kernel to read from these uninitialized entries during HMAC computation. This can lead to a kernel panic if the peer can control TCP segmentation to isolate the TLS record header in the first mbuf.

A remote attacker who can send specially crafted TLS 1.2 CBC records and control TCP segmentation could cause the kernel to read uninitialized memory during HMAC computation, resulting in a kernel panic. This leads to a denial of service condition on the affected system. There is no indication of information disclosure or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigating this vulnerability may require restricting or monitoring TLS 1.2 CBC traffic or disabling ktls for TLS 1.2 CBC records if possible. No official fix or workaround is currently documented in the provided data.