A critical off-by-one memory corruption vulnerability in the Linux kernel TLS subsystem may allow for remote exploitation and system compromise.

This vulnerability is an off-by-one error occurring in the tls_push_record function when the scatterlist ring wraps, which triggers an incorrect calculation of the sg_chain entry count. The vulnerability can be triggered by an unauthenticated attacker sending specially crafted network traffic, as the flaw resides within the TLS processing logic.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for remote code execution and total system compromise. Successful exploitation could lead to unauthorized data access, complete service disruption, or the execution of arbitrary code with kernel-level privileges. Given the foundational role of the Linux kernel, this flaw represents a severe risk to the integrity and availability of any infrastructure relying on affected kernel versions.

Immediate Action: Update the Linux kernel to the corrected versions: 5.10.258, 5.15.209, 6.1.175, 6.6.142, or later stable releases as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events, segmentation faults, or unusual network traffic patterns targeting TLS-enabled services.

Compensating Controls: Ensure that network-level security controls, such as Intrusion Detection Systems (IDS), are configured to detect and block malformed TLS packets that may exploit memory management logic.

Public Exploit Available: Unknown.

This vulnerability is classified as critical due to its potential for unauthenticated remote exploitation. Organizations should prioritize patching their Linux kernels to the specified stable versions immediately to prevent potential system compromise. If an immediate reboot is not feasible, ensure that compensating controls are active and monitor for any signs of anomalous system behavior or service instability.