CVE-2026-52974 net: tls: fix strparser anchor skb leak on offload RX setup failure
A memory leak in the Linux kernel TLS offload error path allows attackers to cause denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52974?
CVE-2026-52974 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix strparser anchor skb leak on offload RX setup failure
When tls_set_device_offload_rx() fails at tls_dev_add(), the error path calls tls_sw_free_resources_rx() to clean up the SW context that was initialized by tls_set_sw_offload(). This function calls tls_sw_release_resources_rx() (which stops the strparser via tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context), but never frees the anchor skb that was allocated by alloc_skb(0) in tls_strp_init().
Note that tls_sw_free_resources_rx() is exclusively used for this "failed to start offload" code path, there's no other caller.
The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), because the standard strparser doesn't try to pre-allocate an skb.
The normal close path in tls_sk_proto_close() handles cleanup by calling tls_sw_strparser_done() (which calls tls_strp_done()) after dropping the socket lock, because tls_strp_done() does cancel_work_sync() and the strparser work handler takes the socket lock.
Weakness: CWE-401
Which versions are affected by CVE-2026-52974?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52974?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-52974 being exploited?
There is no known exploitation of CVE-2026-52974 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-52974, DEBIAN-CVE-2026-52974, GHSA-5jx6-m427-9p5p, ROOT-OS-DEBIAN-12-CVE-2026-52974, ROOT-OS-UBUNTU-2404-CVE-2026-52974, UBUNTU-CVE-2026-52974.