Out-of-bounds write in Linux kernel - CVE-2026-80852
Published: September 5, 2026
Vulnerability identifier: #VU147060
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80852
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in tls_append_frag() in the TLS device offload implementation when repeatedly splicing small amounts of data into a TLS_TX_ZEROCOPY_RO socket using SPLICE_F_MORE and MSG_MORE. A local user can cause the fragment count to exceed the maximum array bound to cause a denial of service.
The vulnerable path requires TLS device offload support.
Affected software
Linux kernel
How to mitigate CVE-2026-80852
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/03ced5da6120965d80ed56dbb7d78fa5c9128906
- https://git.kernel.org/stable/c/7e1208c135618358da5d7d6664874dc6e53c62fc
- https://git.kernel.org/stable/c/a832d7cb09da2a8e4e9734b4be14d3e76169d805
- https://git.kernel.org/stable/c/b17cf742eaad70ae29ac558cefb3aa9bbeea03d4
- https://git.kernel.org/stable/c/b7f10d4ff987bda038df90052cd4a1434a7412d4
- https://git.kernel.org/stable/c/cd7e875b89597f3498917af764758391338d1802
- https://git.kernel.org/stable/c/fadbc1ed2a872a8649a44cf9e1cf9621fc58cd6e