In the Linux kernel, the TLS subsystem fails to propagate an async decryption error into the splice read path. When a decrypt operation fails, the kernel records the error but only the receive functions check that error before reading. The splice function does not perform this check, so a splice can continue to deliver partial or unauthenticated records over a connection that other TLS readers refuse. This flaw allows an attacker to keep an otherwise broken TLS connection active, potentially causing resource exhaustion or enabling the transmission of data that should be rejected, which leads to denial of service and possible information disclosure.

Vendors: Linux kernel. Products: Linux kernel. No specific affected versions are listed in the CNA data.

The CVSS score and EPSS are not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote attacker who can manipulate TLS traffic to trigger a decrypt error. The flaw relies on a kernel error that is normally reported via sk_err, but the splice code ignores this signal. The risk is therefore moderate to high in environments that use the splice path for TLS connections. The absence of a public exploit yet does not preclude potential use in custom attacks.