CVE-2026-64047 (GCVE-0-2026-64047)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two elements: * 1) used for chaining the front and sections when the list becomes * partitioned (e.g. end < start). The crypto APIs require the * chaining; * 2) to chain tailer SG entries after the message. */ struct scatterlist data[MAX_MSG_FRAGS + 2]; The current code uses MAX_SKB_FRAGS + 1 as the ring size: sg_chain(&msg_pl->sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS] instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down") Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 73963a375885d5ccb7def39fd0b4f542e0f343dd (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 47110c3a9ac247b688657337f5981efcfcb240dc (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 84158c2997159df4a0d70cd9c46774512d32a522 (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 131ef12057d92b77b636321b7849c69222405a97 (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 66339b71f105e6f83e0da3b9583d95077534fe1d (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < eca989eab4b2599dcb02f72140a7c08f08838520 (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 2fb0dc7e0099686c4e9d2732745d8a31b18c3628 (git)
Affected: 9aaaa56845a06aeabdd597cbe19492dc01f281ec , < 285943c6e7ca309bbea84b253745154241d9788a (git)
Affected: d529d6c9f7e3aaeac13c4948f79799ccb825f29d (git)
Affected: 5.4.14 , < 5.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73963a375885d5ccb7def39fd0b4f542e0f343dd",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "47110c3a9ac247b688657337f5981efcfcb240dc",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "84158c2997159df4a0d70cd9c46774512d32a522",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "131ef12057d92b77b636321b7849c69222405a97",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "66339b71f105e6f83e0da3b9583d95077534fe1d",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "eca989eab4b2599dcb02f72140a7c08f08838520",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "2fb0dc7e0099686c4e9d2732745d8a31b18c3628",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "285943c6e7ca309bbea84b253745154241d9788a",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d529d6c9f7e3aaeac13c4948f79799ccb825f29d",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\nWhen an sk_msg scatterlist ring wraps (sg.end \u003c sg.start),\ntls_push_record() chains the tail portion of the ring to the head\nusing sg_chain(). An extra entry in the sg array is reserved for\nthis:\n\n  struct sk_msg_sg {\n        [...]\n        /* The extra two elements:\n         * 1) used for chaining the front and sections when the list becomes\n         *    partitioned (e.g. end \u003c start). The crypto APIs require the\n         *    chaining;\n         * 2) to chain tailer SG entries after the message.\n         */\n        struct scatterlist              data[MAX_MSG_FRAGS + 2];\n\nThe current code uses MAX_SKB_FRAGS + 1 as the ring size:\n\n    sg_chain(\u0026msg_pl-\u003esg.data[msg_pl-\u003esg.start],\n             MAX_SKB_FRAGS - msg_pl-\u003esg.start + 1,\n             msg_pl-\u003esg.data);\n\nThis places the chain pointer at\n\n  sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =\n  \u0026data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =\n  data[start + (MAX_SKB_FRAGS - start + 1) - 1] =\n  data[MAX_SKB_FRAGS]\n\ninstead of the true last entry. This is likely due to a \"race\" of\nthe commit under Fixes landing close to\ncommit 031097d9e079 (\"bpf: sk_msg, zap ingress queue on psock down\")\n\nConvert to ARRAY_SIZE and drop the data[start] / - start (as suggested\nby Sabrina)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in kernel TLS (kTLS) software transmit encryption triggered when a TLS socket sends records; remote peers on established TLS connections drive this TX path through normal network I/O.\nAC:L - An attacker who controls connection traffic can reliably create the wrapped sk_msg ring state via BPF sockmap SK_MSG verdict helpers (push/pop/redirect) and then trigger record push on demand.\nPR:N - Exploitation requires no privileges on the target host beyond being a network peer on a kTLS socket with sockmap BPF already configured by the service; attacker capabilities are not needed on the victim system.\nUI:N - Triggering requires only automated server-side TLS transmit activity in response to network input, with no victim user action.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same kernel/host security boundary, not a cross-VM or sandbox escape by itself.\nC:H - Corrupting an active scatterlist entry causes the AEAD crypto path to follow an incorrect chain, enabling out-of-bounds kernel memory reads beyond intended plaintext buffers.\nI:H - The malformed scatterlist passed to crypto_aead_encrypt() can direct encryption I/O to wrong memory regions, providing an out-of-bounds write primitive exploitable for control-flow hijacking.\nA:H - Scatterlist corruption in the kernel crypto TX path can cause kernel oopses, panics, or fatal BUG conditions when invalid chain entries or page pointers are dereferenced."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:39.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522"
        },
        {
          "url": "https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628"
        },
        {
          "url": "https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a"
        }
      ],
      "title": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64047",
    "datePublished": "2026-07-19T15:39:31.960Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:39.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64047",
      "date": "2026-09-20",
      "epss": "0.00514",
      "percentile": "0.42775"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tls/tls_sw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "73963a375885d5ccb7def39fd0b4f542e0f343dd",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47110c3a9ac247b688657337f5981efcfcb240dc",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84158c2997159df4a0d70cd9c46774512d32a522",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "131ef12057d92b77b636321b7849c69222405a97",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "66339b71f105e6f83e0da3b9583d95077534fe1d",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eca989eab4b2599dcb02f72140a7c08f08838520",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2fb0dc7e0099686c4e9d2732745d8a31b18c3628",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "285943c6e7ca309bbea84b253745154241d9788a",
                    "status": "affected",
                    "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d529d6c9f7e3aaeac13c4948f79799ccb825f29d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.14",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tls/tls_sw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "29027300-C7E0-4C87-A607-355605B77795",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE3D8C6B-EEB3-4854-B99E-EC2549DD3071",
                    "versionEndExcluding": "5.10.258",
                    "versionStartIncluding": "5.5.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4",
                    "versionEndExcluding": "5.15.209",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA",
                    "versionEndExcluding": "6.1.175",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBFF77B0-526A-4AF1-84D0-ED7187624A67",
                    "versionEndExcluding": "6.6.142",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                    "versionEndExcluding": "6.12.92",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*",
                    "matchCriteriaId": "EE98F46A-F7D9-4609-B6A0-882E7F0D378C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "3444D854-CE07-4D25-827A-ECF7BB58EA2D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\nWhen an sk_msg scatterlist ring wraps (sg.end \u003c sg.start),\ntls_push_record() chains the tail portion of the ring to the head\nusing sg_chain(). An extra entry in the sg array is reserved for\nthis:\n\n  struct sk_msg_sg {\n        [...]\n        /* The extra two elements:\n         * 1) used for chaining the front and sections when the list becomes\n         *    partitioned (e.g. end \u003c start). The crypto APIs require the\n         *    chaining;\n         * 2) to chain tailer SG entries after the message.\n         */\n        struct scatterlist              data[MAX_MSG_FRAGS + 2];\n\nThe current code uses MAX_SKB_FRAGS + 1 as the ring size:\n\n    sg_chain(\u0026msg_pl-\u003esg.data[msg_pl-\u003esg.start],\n             MAX_SKB_FRAGS - msg_pl-\u003esg.start + 1,\n             msg_pl-\u003esg.data);\n\nThis places the chain pointer at\n\n  sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =\n  \u0026data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =\n  data[start + (MAX_SKB_FRAGS - start + 1) - 1] =\n  data[MAX_SKB_FRAGS]\n\ninstead of the true last entry. This is likely due to a \"race\" of\nthe commit under Fixes landing close to\ncommit 031097d9e079 (\"bpf: sk_msg, zap ingress queue on psock down\")\n\nConvert to ARRAY_SIZE and drop the data[start] / - start (as suggested\nby Sabrina)."
          }
        ],
        "id": "CVE-2026-64047",
        "lastModified": "2026-09-02T21:11:06.000",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:45.053",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-193"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T16:44:42+00:00",
      "cve": "CVE-2026-64047",
      "id": "CVE-2026-64047",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64047.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:44:31Z",
      "cve": "CVE-2026-64047",
      "id": "CVE-2026-64047",
      "initial_release_date": "2026-07-21T13:00:40Z",
      "product_status:first_fixed": "73",
      "product_status:known_affected": "636",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64047",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64047.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.