CVE-2026-80904: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80904 is an authentication bypass vulnerability in the Linux kernel's TLS (Transport Layer Security) subsystem, specifically in the net/tls module. The flaw causes tls_sw_splice_read() to continue delivering TLS records on a connection even after an asynchronous decryption failure, bypassing the authentication enforcement present in the other two read paths (tls_sw_recvmsg() and tls_sw_read_sock()). It affects Linux kernel versions from 5.19 up to (but not including) the patched stable releases. Fixed versions include 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. The CVSS estimate is Medium, with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is an improper error-handling omission (CWE-754: Improper Check for Unusual or Exceptional Conditions) in tls_sw_splice_read() within the Linux kernel's net/tls subsystem. When an asynchronous TLS decryption operation fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort() to store it in sk_err. While tls_sw_recvmsg() and tls_sw_read_sock() both check async_wait.err after acquiring the reader lock and abort on failure, tls_sw_splice_read() has no such check. Additionally, tls_rx_rec_wait() only tests sk_err inside a loop that is skipped when a record is already parsed, and the first reader to call sock_error() clears sk_err while async_wait.err persists — meaning a splice() call can keep reading unauthenticated records. The fix adds the same async_wait.err check to tls_sw_splice_read() (GitHub Advisory, Kernel Patch).

A local user with access to a TLS socket can use the splice() system call to read encrypted TLS records from a connection after authentication has failed, effectively bypassing the integrity and authentication guarantees of the TLS session. This exposes data that should be considered unauthenticated and potentially tampered, undermining the confidentiality and integrity protections TLS is intended to provide. The impact is limited to local users on the affected system with access to the relevant TLS socket; remote exploitation is not directly applicable (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the system and the ability to interact with a TLS socket using splice().

Update the Linux kernel to a patched stable version: 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 and later. Distributions based on these stable branches should be monitored for backported security updates. No configuration-based workaround is available; the only remediation is applying the kernel patch that adds async_wait.err checking to tls_sw_splice_read() (GitHub Advisory, Kernel Patch).