An unprivileged user can create a TLS socket on a loopback interface and send data that triggers a NULL pointer dereference in the Linux kernel’s TLS implementation. The fault occurs because the plaintext sk_msg ring becomes full without setting the full_record flag, allowing subsequent operations to wrap indices and corrupt the scatterlist. When the kernel later processes the ring, it walks past the valid memory range, producing a crash. The vulnerability is a null pointer dereference (CWE‑476) and results in a kernel panic, disabling all system processes that rely on the kernel.

All Linux kernel releases that have not incorporated the upstream patch are affected. Vendor listings indicate Linux:Linux, meaning every Linux kernel distribution is potentially impacted until the fix is applied. No specific version number is identified; therefore, all versions previous to the public fix should be treated as vulnerable.

The flaw can be exercised locally by any unprivileged user with access to create a TLS socket on a loopback interface. No privilege escalation occurs, but the resulting kernel crash denies availability to the entire system. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, yet the straightforward attack path suggests a high exploitation likelihood in environments that use TLS over loopback.