A high-severity NULL pointer dereference vulnerability in the Linux kernel TLS subsystem may allow a local attacker to cause a denial of service.

This flaw occurs because the TLS plaintext sk_msg ring is left unpushed when full, triggering a NULL pointer dereference when a later splice operation interacts with the full ring. An unprivileged user can trigger this condition on a loopback TCP socket with the TLS ULP attached.

Successful exploitation of this vulnerability results in a kernel panic, leading to an immediate denial of service for the affected system. Given the CVSS score of 7.8, this represents a significant risk to system availability, particularly in environments where untrusted local users have access to the system.

Immediate Action: Update the Linux kernel to version 6.6.152, 6.12.104, 6.18.45, 7.1.9, or later, as applicable to your distribution.

Proactive Monitoring: Monitor system logs for kernel oops or BUG messages related to TLS or sk_msg operations which may indicate an attempted exploit.

Compensating Controls: Restrict access to the system to authorized users only, and limit the ability of users to attach ULP modules to sockets where possible.

Public Exploit Available: No

Organizations should prioritize patching this kernel vulnerability to prevent potential local denial of service attacks. Apply the vendor-provided security updates to the affected Linux kernel versions immediately to eliminate the risk of kernel-level instability.