CVE-2026-23414: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23414 is a memory leak vulnerability in the Linux kernel's TLS (Transport Layer Security) asynchronous decryption subsystem. The flaw exists in the tls_decrypt_async_wait() function, which fails to purge the async_hold queue — a structure that pins encrypted socket buffers (skbs) while the AEAD engine processes them — under certain error conditions. Affected Linux kernel versions include 6.1.158–6.1.167, 6.6.114–6.6.130, 6.12.55–6.12.79, 6.17.5–6.18.20, 6.18.1–6.18.20, 6.19.0–6.19.10, and release candidates 7.0-rc1 through 7.0-rc7. It was published on April 2, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The async_hold queue in the kernel TLS software receive path (tls_sw_recvmsg()) only flushes held skbs when a record has been fully processed in "fully-async" mode. When tls_strp_msg_hold() fails partway through — after some cloned skbs have already been added to async_hold — tls_decrypt_sg() calls tls_decrypt_async_wait() to drain pending decryptions and falls back to synchronous mode, but the async_hold queue is never purged in this code path. The fix centralizes __skb_queue_purge(&ctx->async_hold) inside tls_decrypt_async_wait() so all callers (recvmsg drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path) consistently release held skbs upon synchronization (GitHub Advisory, Feedly).

Repeated TLS decryption failures on affected systems cause encrypted socket buffers to remain pinned in kernel memory indefinitely, leading to progressive memory exhaustion. Over time, this can result in denial of service conditions and potential kernel crashes, particularly on systems handling high-volume TLS connections or experiencing frequent AEAD decryption errors. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability requires local access with low privileges (a local user able to trigger TLS decryption operations), limiting its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Apply the available kernel patches for the affected version in use. Fixed versions are: 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0-rc6 or later. Patch commits are available at git.kernel.org. Downstream distributions including SUSE, Debian, and Amazon Linux 2023 have released updated packages (GitHub Advisory, SUSE Advisory, Amazon Linux). As a temporary workaround where patching is not immediately possible, limiting TLS connection volume to reduce the frequency of decryption failures may help mitigate memory exhaustion risk (Feedly).

The vulnerability was announced via the Linux kernel CVE mailing list and tracked by multiple downstream vendors including SUSE, Debian, and Amazon Linux, all of which issued updated packages (SUSE Advisory, Debian Tracker). Tenable published multiple Nessus detection plugins for the vulnerability. No significant independent researcher commentary or social media discussion beyond routine CVE tracking was observed.