CVE-2026-52974 - Vulnerability Details

- net: tls: fix strparser anchor skb leak on offload RX setup failure

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix strparser anchor skb leak on offload RX setup failure

When tls_set_device_offload_rx() fails at tls_dev_add(), the error path
calls tls_sw_free_resources_rx() to clean up the SW context that was
initialized by tls_set_sw_offload(). This function calls
tls_sw_release_resources_rx() (which stops the strparser via
tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),
but never frees the anchor skb that was allocated by alloc_skb(0) in
tls_strp_init().

Note that tls_sw_free_resources_rx() is exclusively used for this
"failed to start offload" code path, there's no other caller.

The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use
the standard strparser"), because the standard strparser doesn't try
to pre-allocate an skb.

The normal close path in tls_sk_proto_close() handles cleanup by calling
tls_sw_strparser_done() (which calls tls_strp_done()) after dropping
the socket lock, because tls_strp_done() does cancel_work_sync() and
the strparser work handler takes the socket lock.

Published: 2026-06-24

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A fault in the Linux kernel’s TLS offload subsystem causes an anchor socket buffer (skb) to remain allocated when a receive offload setup fails. The error path in tls_set_device_offload_rx() fails to free the skb that allocates in tls_strp_init(), resulting in a memory leak that can accumulate during repeated failures.

Affected Systems

All Linux kernel builds that include the TLS offload feature without the commit that releases the anchor skb are affected. This includes generic Linux kernel releases prior to the patch that removed the skb allocation in the offload error path.

Risk and Exploitability

The CVSS score of 7.5 reflects a high severity, and the EPSS score is below 1%, indicating a very low likelihood of active exploitation. The leak does not provide code execution or direct network intrusion, but an attacker who can repeatedly trigger offload failures could exhaust kernel memory or degrade system performance, possibly leading to a denial of service. The vulnerability is not listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< 0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< 688f12aa44511dd57e448eb670075c6302ad1dc1
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< 3c405dfa9619e506e75b8e41f8b29a5b99731877
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< 9c54e76f8d6eb11735918777ef0e0509e089557d
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc
`84c61fe1a75b4255df1e1e7c054c9e6d048da417`	affected	< 58689498ca3384851145a754dbb1d8ed1cf9fb54

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[84c61fe1a75b4255df1e1e7c054c9e6d048da417,0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32)`	affected	code_commit	—
`[84c61fe1a75b4255df1e1e7c054c9e6d048da417,688f12aa44511dd57e448eb670075c6302ad1dc1)`	affected	code_commit	—
`[84c61fe1a75b4255df1e1e7c054c9e6d048da417,3c405dfa9619e506e75b8e41f8b29a5b99731877)`	affected	code_commit	—
`[84c61fe1a75b4255df1e1e7c054c9e6d048da417,58689498ca3384851145a754dbb1d8ed1cf9fb54)`	affected	code_commit	—
`[84c61fe1a75b4255df1e1e7c054c9e6d048da417,bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	semver	—
`[0,6.0)`	unaffected	semver	—
`[6.1.175,7.0.0)`	unaffected	semver	—
`[6.6.141,7.0.0)`	unaffected	semver	—
`[6.12.91,7.0.0)`	unaffected	semver	—
`[6.18.33,7.0.0)`	unaffected	semver	—
`[7.0.10,8.0.0)`	unaffected	semver	—
`[7.1,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit fixing the skb leak in the TLS offload error path
If an immediate kernel update is not possible, disable TLS offload or force TLS to run in software mode to avoid the affected error path
Monitor system memory usage for abnormal growth and consider applying cgroup limits to constrain kernel memory consumption per process

Generated by OpenCVE AI on June 28, 2026 at 14:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00506.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32
https://git.kernel.org/stable/c/3c405dfa9619e506e75b8e41f8b29a5b99731877
https://git.kernel.org/stable/c/58689498ca3384851145a754dbb1d8ed1cf9fb54
https://git.kernel.org/stable/c/688f12aa44511dd57e448eb670075c6302ad1dc1
https://git.kernel.org/stable/c/9c54e76f8d6eb11735918777ef0e0509e089557d
https://git.kernel.org/stable/c/bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc
https://lore.kernel.org/linux-cve-announce/2026062440-CVE-2026-52974-f4e7@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52974
https://www.cve.org/CVERecord?id=CVE-2026-52974

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 27 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026062440-CVE-2026-52974-f4e7@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52974 https://www.cve.org/CVERecord?id=CVE-2026-52974
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: tls: fix strparser anchor skb leak on offload RX setup failure When tls_set_device_offload_rx() fails at tls_dev_add(), the error path calls tls_sw_free_resources_rx() to clean up the SW context that was initialized by tls_set_sw_offload(). This function calls tls_sw_release_resources_rx() (which stops the strparser via tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context), but never frees the anchor skb that was allocated by alloc_skb(0) in tls_strp_init(). Note that tls_sw_free_resources_rx() is exclusively used for this "failed to start offload" code path, there's no other caller. The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), because the standard strparser doesn't try to pre-allocate an skb. The normal close path in tls_sk_proto_close() handles cleanup by calling tls_sw_strparser_done() (which calls tls_strp_done()) after dropping the socket lock, because tls_strp_done() does cancel_work_sync() and the strparser work handler takes the socket lock.
Title		net: tls: fix strparser anchor skb leak on offload RX setup failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32 https://git.kernel.org/stable/c/3c405dfa9619e506e75b8e41f8b29a5b99731877 https://git.kernel.org/stable/c/58689498ca3384851145a754dbb1d8ed1cf9fb54 https://git.kernel.org/stable/c/688f12aa44511dd57e448eb670075c6302ad1dc1 https://git.kernel.org/stable/c/9c54e76f8d6eb11735918777ef0e0509e089557d https://git.kernel.org/stable/c/bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:28:51.826Z

Updated: 2026-06-28T06:37:28.883Z

Reserved: 2026-06-09T07:44:35.375Z

Link: CVE-2026-52974

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52974 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:45:17Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object