An unprivileged user can create a TLS socket on a loopback interface and send data that triggers a NULL pointer dereference in the Linux kernel’s TLS implementation. The fault occurs because the plaintext sk_msg ring becomes full without setting the full_record flag, allowing subsequent operations to wrap indices and corrupt the scatterlist. When the kernel later processes the ring, it walks past the valid memory range, producing a crash. The vulnerability is a null pointer dereference and results in a kernel panic, disabling all system processes that rely on the kernel.

All Linux kernel releases that have not incorporated the upstream patch are affected. Vendor listings indicate Linux:Linux, meaning every Linux kernel distribution is potentially impacted until the fix is applied. No specific version number is identified; therefore, all versions previous to the public fix should be treated as vulnerable.

The flaw can be exercised locally by any unprivileged user with access to create a TLS socket on a loopback interface. No privilege escalation occurs, but the resulting kernel crash denies availability to the entire system. The CVSS score of 7.8 highlights this vulnerability as high severity. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, but the straightforward attack path suggests that the vulnerability could be exploited in environments that use TLS over loopback.