The Linux kernel’s TLS 1.3 receive path allows an attacker to cause overwritten user‑visible data. When the kernel attempts an optimistic zero‑copy decryption and later discovers that the decrypted record is not unpadded application data, it retries using a kernel skb but leaves the message iterator advanced. The subsequent copy writes the decrypted bytes into iovec entries that lie beyond the length reported by recvmsg(), corrupting data passed to the application.

Any system running a Linux kernel that contains the unpatched implementation is affected. The vulnerability applies to all distributions whose kernels include the vulnerable code prior to the commit that restores the iterator before retrying. The specific affected kernel versions are not enumerated in the advisory, so any kernel version before the patch must be considered vulnerable.

A remote TLS client that sends a TLS 1.3 control record while TLS_RX_EXPECT_NO_PAD is enabled can trigger the flaw. The resulting data overwrite can lead to integrity violations or application crashes. No CVSS or EPSS score is publicly available, and the flaw is not listed in CISA’s KEV catalog, but the absence of metrics does not mitigate the potential impact for unpatched systems.