CVE-2026-23414 tls: Purge async_hold in tls_decrypt_async_wait()
A memory leak in the Linux kernel TLS subsystem allows attackers to cause denial of service by exhausting kernel memory through specific decryption failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23414?
CVE-2026-23414 is a high-severity denial of service vulnerability in Linux kernel, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tls: Purge async_hold in tls_decrypt_async_wait()
The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no longer references those skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to tls_sw_read_sock(), introducing a new call site that must drain pending AEAD operations and release held skbs. Move __skb_queue_purge(&ctx->async_hold) into tls_decrypt_async_wait() so the purge is centralized and every caller -- recvmsg's drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path -- releases held skbs on synchronization without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through, after having added some cloned skbs to the async_hold queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to process all pending decrypts, and drop back to synchronous mode, but tls_sw_recvmsg() only flushes the async_hold queue when one record has been processed in "fully-async" mode, which may not be the case here.
[[email protected]: added leak comment]
Weakness: CWE-401
Which versions are affected by CVE-2026-23414?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23414?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23414 being exploited?
There is no known exploitation of CVE-2026-23414 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-84056, BELL-CVE-2026-23414, DEBIAN-CVE-2026-23414, GHSA-8fgp-q3pf-q3rh, ROOT-OS-DEBIAN-12-CVE-2026-23414, ROOT-OS-DEBIAN-13-CVE-2026-23414 and 2 more.