Homepage

Out-of-bounds Write The advisory has been revoked - it doesn't affect any version of package kernel-rt-64k-modules-extra  (opens in a new tab)

Threat Intelligence

EPSS
0.49% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-KERNELRT64KMODULESEXTRA-19247650
  • published25 Aug 2026
  • disclosed22 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Aug 2026

CVE-2026-74611  (opens in a new tab)
CWE-787  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-64k-modules-extra package and not the kernel-rt-64k-modules-extra package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

tls: rx: restore msg_iter before TLS 1.3 optimistic retry

tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced.

The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD.

Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy.

Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.