An empty TLS application_data record, which the TLS 1.3 protocol allows as a traffic‑analysis countermeasure, can be sent by a peer. In Linux, the decrypted record has full_len == 0, and the read actor returns zero bytes. The kernel’s read loop treats this as backpressure, requeues the packet, and stops processing further packets. Repeating this cycle blocks all subsequent TLS traffic, effectively freezing the connection and causing a denial of service. The flaw does not enable arbitrary code execution or information disclosure, but it disrupts the availability of TLS‑protected services.

All Linux kernel releases that include the tls_sw_read_sock() code path are affected until the commit that consumes empty TLS records is merged. No specific version range is published, so all potentially vulnerable kernel versions should be checked against the vendor’s change list for the fix. The vulnerability applies to the kernel’s TLS software implementation regardless of distribution.

The flaw can be triggered remotely by an attacker who establishes a TLS connection and transmits a zero‑length application_data record. Once activated, the vulnerable read path stalls the entire connection, leading to a service interruption. The CVSS score of 7.5 classifies the vulnerability as high severity. The EPSS score of < 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is straightforward and the impact is significant because it targets high‑availability services that rely on TLS. The risk is considered moderate to high pending further exploitation data.