CVE-2026-72330 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure their systems are updated with the latest patches to prevent potential issues with TLS application_data records. They should review system configurations for TLS application_data record handling and monitor system logs for potential issues with TLS records. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Technical summary

The Linux kernel has a vulnerability related to handling TLS application_data records. A peer may send a zero-length TLS application_data record, which can cause issues with the tls_sw_read_sock() function. The record has full_len == 0 after decryption. The loop treats a zero return as backpressure and requeues the skb at the head of rx_list, stopping progress. Users should ensure their systems are updated with the latest patches. The vulnerability affects Linux kernel users and administrators.

Defensive priority

Linux kernel users should verify their systems are updated with the latest patches to prevent potential issues with TLS application_data records.

Recommended defensive actions

• Verify Linux kernel is updated with the latest patches
• Review system configurations for TLS application_data record handling
• Monitor system logs for potential issues with TLS records
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates a vulnerability in the Linux kernel related to handling TLS application_data records. A peer may send a zero-length TLS application_data record, which can cause issues with the tls_sw_read_sock() function. The record has full_len == 0 after decryption. The loop treats a zero return as backpressure and requeues the skb at the head of rx_list, stopping progress. Users should ensure their systems are updated with the latest patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.