CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fail tlsswsplice_read() after a failed async decrypt

When an async decrypt fails, tlsdecryptdone() records the error in ctx->asyncwait.err and calls tlserrabort(), which stores it in skerr. tlsswrecvmsg() and tlsswreadsock() each read asyncwait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.

tlsswspliceread() has no such check, and skerr does not stand in for one. tlsrxrecwait() tests skerr only inside the loop it skips whenever a record is already parsed, and the first reader to reach sockerror() clears it, while asyncwait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read.

Read asyncwait.err in tlsswspliceread() as the other two readers do.