Answer in brief
CVE-2026-74611 records a Critical severity (CVSS 9.8) vulnerability in tls: rx: restore msg_iter before TLS 1.3 optimistic retry. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ce61327ce989b63c0bd1cc7afee00e218ee696ac <68787940274ec89f41dc91b1a68ee1a16a90735f || >=ce61327ce989b63c0bd1cc7afee00e218ee696ac <3c837266a734e2a22b24d2d567404a501d405835 || >=ce61327ce989b63c0bd1cc7afee00e218ee696ac <1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e | 68787940274ec89f41dc91b1a68ee1a16a90735f, 3c837266a734e2a22b24d2d567404a501d405835, 1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e |
| Linux/Linuxgeneric | 6.0 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.
Quoted source text, attributed separately from HOL analysis.