CVE-2026-64047 - Vulnerability Details

- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

When an sk_msg scatterlist ring wraps (sg.end < sg.start),
tls_push_record() chains the tail portion of the ring to the head
using sg_chain(). An extra entry in the sg array is reserved for
this:

struct sk_msg_sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];

The current code uses MAX_SKB_FRAGS + 1 as the ring size:

sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
MAX_SKB_FRAGS - msg_pl->sg.start + 1,
msg_pl->sg.data);

This places the chain pointer at

sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =
&data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =
data[start + (MAX_SKB_FRAGS - start + 1) - 1] =
data[MAX_SKB_FRAGS]

instead of the true last entry. This is likely due to a "race" of
the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")

Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested
by Sabrina).

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s TLS stack can produce an off‑by‑one error while chaining the tail of a wrapped sk_msg scatterlist ring. The bug causes the sg_chain function to point to an element past the intended array bounds during tls_push_record(), potentially corrupting kernel memory.

Affected Systems

Linux kernel installations that have not integrated the recent patch are vulnerable, notably kernel version 5.5, its 5.5‑rc7 release candidate, 7.1‑rc1 through 7.1‑rc3, and any other kernel releases lacking the referenced commit.

Risk and Exploitability

The vulnerability has a CVSS score of 9.8 and an EPSS score of less than 1 %. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network‑based, using crafted TLS traffic to trigger the wrap condition; the vulnerability is not explicitly confirmed to be exploitable in this manner. The low EPSS indicates that exploitation in the wild is unlikely at this time. Nonetheless, the flaw must be remediated as soon as possible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 73963a375885d5ccb7def39fd0b4f542e0f343dd
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 47110c3a9ac247b688657337f5981efcfcb240dc
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 84158c2997159df4a0d70cd9c46774512d32a522
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 131ef12057d92b77b636321b7849c69222405a97
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 66339b71f105e6f83e0da3b9583d95077534fe1d
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< eca989eab4b2599dcb02f72140a7c08f08838520
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 2fb0dc7e0099686c4e9d2732745d8a31b18c3628
`9aaaa56845a06aeabdd597cbe19492dc01f281ec`	affected	< 285943c6e7ca309bbea84b253745154241d9788a
`d529d6c9f7e3aaeac13c4948f79799ccb825f29d`	affected	—
`5.4.14`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.5`	affected	—
`0`	unaffected	< 5.5
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.5:-::::::
	cpe:2.3:o:linux:linux_kernel:5.5:rc7::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,73963a375885d5ccb7def39fd0b4f542e0f343dd)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,47110c3a9ac247b688657337f5981efcfcb240dc)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,66339b71f105e6f83e0da3b9583d95077534fe1d)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,84158c2997159df4a0d70cd9c46774512d32a522)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,eca989eab4b2599dcb02f72140a7c08f08838520)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,2fb0dc7e0099686c4e9d2732745d8a31b18c3628)`	affected	code_commit	—
`[9aaaa56845a06aeabdd597cbe19492dc01f281ec,285943c6e7ca309bbea84b253745154241d9788a)`	affected	code_commit	—
`d529d6c9f7e3aaeac13c4948f79799ccb825f29d`	affected	code_commit	—
`[5.4.14,5.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.5`	affected	semver	—
`[0,5.5)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that fixes CVE‑2026‑64047.
Upgrade to the latest stable Linux kernel that includes this fix.
If the patch cannot be applied immediately, consider disabling TLS offloading or related network stack features to mitigate exposure.

Generated by OpenCVE AI on October 20, 2026 at 09:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8729-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8761-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8729-2	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8761-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8729-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8802-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8729-4	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8729-5	Linux kernel (AWS FIPS) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8729-6	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97
https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a
https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628
https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc
https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d
https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd
https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522
https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520
https://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-64047-e420@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64047
https://www.cve.org/CVERecord?id=CVE-2026-64047

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-191

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 02 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:5.5:-:::::: cpe:2.3:o:linux:linux_kernel:5.5:rc7:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-193
References		https://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-64047-e420@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64047 https://www.cve.org/CVERecord?id=CVE-2026-64047
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two elements: * 1) used for chaining the front and sections when the list becomes * partitioned (e.g. end < start). The crypto APIs require the * chaining; * 2) to chain tailer SG entries after the message. */ struct scatterlist data[MAX_MSG_FRAGS + 2]; The current code uses MAX_SKB_FRAGS + 1 as the ring size: sg_chain(&msg_pl->sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS] instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down") Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina).
Title		net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97 https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628 https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522 https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:31.960Z

Updated: 2026-10-19T20:28:10.717Z

Reserved: 2026-07-19T07:54:57.029Z

Link: CVE-2026-64047

Vulnrichment

Updated: 2026-10-16T15:35:55.201Z

NVD

Status : Modified

Published: 2026-07-19T16:17:45.053

Modified: 2026-10-19T21:17:21.780

Link: CVE-2026-64047

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64047 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T09:45:06Z

Weaknesses

CWE-191
Integer Underflow (Wrap or Wraparound)
CWE-193
Off-by-one Error

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object