In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS
    1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic
    TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,
    tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the
    skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only
    the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert
    the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy.
    Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that
    recvmsg() does not overwrite later iovecs beyond the returned length. (CVE-2026-74611)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it     maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be     unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced.
    The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs     while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables     TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before     retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD     enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.
    (CVE-2026-74611)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471291	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	critical
471291	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
469964	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.28	Tenable Cloud Security	Google COS Security Checks	Local	critical
469964	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.28	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
351016	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3139)	Nessus	Amazon Linux Local Security Checks	Local	critical
338916	Linux Distros Unpatched Vulnerability : CVE-2026-74611	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-74611

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical