CVE-2026-64046: Linux Kernel TLS Out-of-Bounds Read (ZDI-26-701) — Detection, Hardening, and Remediation Guide

The Zero Day Initiative has published ZDI-26-701, disclosing CVE-2026-64046 — an out-of-bounds read vulnerability in the Linux kernel's TLS (kTLS) protocol implementation. ZDI rates the flaw at CVSS 6.7 (Medium-High), and while the preconditions for exploitation are meaningful — the attacker must already be able to execute high-privileged code locally — this class of bug is exactly what sophisticated intruders reach for during post-compromise privilege consolidation and credential theft.

Why should you care? Because information disclosure in kernel space is never just an information disclosure. Kernel memory can contain cryptographic key material, TLS session secrets, credentials, and pointers that defeat KASLR — turning a medium-severity local bug into a force multiplier for an attacker who already has a foothold. If your environment runs kernel TLS offloading (common in high-throughput web, database, and storage workloads, and increasingly in service-mesh and container-native networking), this advisory belongs on this week's patching radar.

Technical Analysis

Affected Component

The flaw resides in the Linux kernel's TLS protocol layer — the net/tls subsystem that implements kTLS, the kernel-space TLS record processing path. kTLS allows TLS encryption/decryption to be handled in-kernel (via setsockopt() with SOL_TLS, TLS_TX/TLS_RX), and is used by applications such as Nginx, HAProxy, Samba, NVMe-TCP, and various userspace crypto offloads.

• Advisory: ZDI-26-701 (http://www.zerodayinitiative.com/advisories/ZDI-26-701/)
• CVE: CVE-2026-64046
• CVSS: 6.7 — local attack vector, high privileges required
• Impact: Out-of-bounds read → disclosure of sensitive kernel memory contents
• Platforms: Linux systems shipping kernels with the vulnerable TLS implementation. Specific affected version ranges should be confirmed against your distribution's security tracker (see Remediation below).

How the Vulnerability Works

An out-of-bounds read in the TLS protocol handler means a crafted or malformed TLS record processed by the kernel can cause the TLS code path to read past the bounds of an allocated buffer. The leaked data can be returned to the caller — meaning a local process with sufficient privilege to exercise the kTLS socket interface can coax the kernel into disclosing adjacent kernel memory.

From a defender's perspective, the exploitation chain looks like this:

1. Foothold + privilege: The attacker already runs high-privileged code (root, or a process with the capabilities needed to configure kTLS sockets). This is a post-exploitation primitive, not an initial access vector.
2. Trigger: The attacker creates a TLS-enabled kernel socket and drives the vulnerable code path with specifically crafted TLS records or configuration parameters.
3. Leak: The out-of-bounds read returns bytes from adjacent kernel heap/stack regions — potentially exposing key material, pointers (KASLR defeat), or data from other tenants/processes.
4. Chain: The disclosed memory is used to build reliable privilege escalation or exploit chaining against harder targets.

Exploitation Status

As of publication, ZDI's advisory describes the vulnerability as requiring local privileged code execution, and there is no confirmed in-the-wild exploitation and no public weaponized PoC documented. It is not currently listed in CISA's Known Exploited Vulnerabilities catalog. That said, the moment a kernel info-leak PoC lands on GitHub, exploit developers will fold it into privilege-escalation chains. The correct posture: treat this as a latent chain component and patch before the tooling matures.

Detection & Response

Detection of an OOB read is inherently difficult — the read itself doesn't crash or log. The defensive opportunity lies in detecting the precondition behaviors: unusual kTLS socket configuration, unexpected privileged processes touching TLS socket options, and anomalies around kernel TLS module usage.

Sigma Rules

---
title: Linux Kernel TLS Socket Configuration by Unusual Process
id: 3f9a1c72-5b8e-4d21-a6c4-9e2f7b0d1a35
status: experimental
description: Detects processes invoking setsockopt-related syscalls or tools to configure kernel TLS (kTLS), which is a precondition for triggering CVE-2026-64046. Uncommon outside known kTLS-enabled applications.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-701/
  - https://attack.mitre.org/techniques/T1211/
author: Security Arsenal
date: 2026/06/14
tags:
  - attack.discovery
  - attack.t1211
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    syscall:
      - 'setsockopt'
      - 'getsockopt'
  selection_key:
    key:
      - 'ktls_watch'
      - 'tls_socket'
  filter_known:
    exe:
      - '/usr/sbin/nginx'
      - '/usr/local/sbin/nginx'
      - '/usr/sbin/haproxy'
      - '/usr/bin/smbd'
      - '/usr/sbin/smbd'
  condition: selection_syscall and selection_key and not filter_known
falsepositives:
  - Legitimate kTLS-enabled applications not in the exclusion list (build an inventory baseline first)
level: medium
---
title: Kernel TLS Module Loaded on Unexpected Host
id: 8c2d4e91-7a3b-4f55-b2d8-6c1e0a9f4b27
status: experimental
description: Detects loading of the tls kernel module via modprobe/insmod. The tls module auto-loads on first kTLS socket use; manual loading on hosts without kTLS workloads may indicate preparation for exploitation of CVE-2026-64046.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-701/
  - https://attack.mitre.org/techniques/T1547.006/
author: Security Arsenal
date: 2026/06/14
tags:
  - attack.persistence
  - attack.t1547.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/modprobe'
      - '/insmod'
  selection_cli:
    CommandLine|contains:
      - ' tls'
      - 'tls.ko'
  condition: selection_img and selection_cli
falsepositives:
  - Administrators enabling kTLS for performance workloads
  - System provisioning and tuning scripts
level: medium

A note on tuning: before deploying these rules broadly, add a one-time auditd watch for kTLS syscall activity on a representative host set to build your baseline of legitimate kTLS consumers. Without that baseline, the first rule will be noisy in environments running TLS-offloaded proxies.

KQL (Microsoft Sentinel — Syslog/auditd ingestion)

Even in a Linux-centric estate, your hunt runs in Sentinel if you forward auditd/syslog. This query hunts for non-baselined processes configuring TLS socket options or loading the tls module:

let KnownKTLSApps = dynamic(["nginx","haproxy","smbd","kubelet","envoy"]);
Syslog
| where TimeGenerated > ago(7d)
| where Facility in ("auth","authpriv","auditd","kernel") or ProcessName in~ ("modprobe","insmod")
| extend Msg = tostring(SyslogMessage)
| where Msg has_any ("SOL_TLS","TLS_TX","TLS_RX","setsockopt","modprobe tls","insmod tls","tls.ko")
| extend Process = coalesce(ProcessName, extract(@"exe=[\"']?([^\s\"']+)", 1, Msg))
| where Process !in~ (KnownKTLSApps)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), SampleMsg=any(Msg)
  by Computer, Process, SeverityLevel
| order by LastSeen desc

If you collect auditd through the Linux auditd connector into the LinuxAuditLog or custom tables, adapt the Syslog table reference accordingly — the logic (filter on known kTLS apps, alert on everything else) is what matters.

Velociraptor VQL

This hunt identifies hosts with the tls kernel module loaded and enumerates processes holding TLS-configured kernel sockets — useful for scoping exposure and spotting unexpected kTLS consumers during triage:

-- Hunt for kernel TLS module usage and processes with kTLS socket options
-- Scope CVE-2026-64046 exposure across the fleet
SELECT {
    SELECT Name, Pid, Ppid, Username, Exe, CommandLine
    FROM pslist()
} AS Processes,
{
    SELECT * FROM file(filename='/sys/module/tls')
} AS TLSModulePresent,
{
    SELECT content FROM read_file(filename='/proc/net/tls_stat', length=8192)
} AS TLSStats
FROM scope()

A sharper variant for live triage — flag processes with open sockets and cross-reference against your known kTLS application list:

-- Identify processes holding sockets on hosts with kTLS active
SELECT Pid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Name =~ '^(nginx|haproxy|smbd|envoy|kubelet)$' = FALSE
  AND CommandLine =~ 'tls|TLS'
ORDER BY Pid

Remediation and Verification Script

#!/bin/bash
# CVE-2026-64046 / ZDI-26-701 — Linux kTLS exposure check and hardening helper
# Run as root. Review before executing in production.

echo "=== [1] Kernel version and kTLS module status ==="
uname -r
if lsmod | grep -q '^tls'; then
  echo "[!] tls kernel module is LOADED"
else
  echo "[+] tls kernel module not currently loaded"
fi

echo ""
echo "=== [2] Checking if tls module auto-loads on demand ==="
modinfo tls >/dev/null 2>&1 && echo "[!] tls module available on this kernel" || echo "[+] tls module not present"

echo ""
echo "=== [3] Identifying kTLS-enabled applications in use ==="
# Known consumers; extend for your environment
grep -l "SOL_TLS\|TLS_TX" /proc/*/cmdline 2>/dev/null | head -20 || echo "No direct hits (expected — socket options aren't in cmdline)."
ss -tlnp 2>/dev/null | head -30

echo ""
echo "=== [4] Optional: blocklist tls module if no kTLS workloads exist ==="
echo "    To blocklist: echo 'blacklist tls' > /etc/modprobe.d/blocklist-ktls.conf"
echo "    Then: update-initramfs -u  (Debian/Ubuntu) or dracut -f (RHEL/Fedora)"
echo "    WARNING: breaks nginx/haproxy kTLS offload, NVMe-TLS, in-kernel SMB TLS if in use."

echo ""
echo "=== [5] Patch check ==="
if command -v apt >/dev/null; then
  apt list --upgradable 2>/dev/null | grep -i linux-image
elif command -v dnf >/dev/null; then
  dnf check-update kernel 2>/dev/null
elif command -v zypper >/dev/null; then
  zypper list-patches --category security 2>/dev/null | grep -i kernel
fi
echo "Apply the latest distribution kernel update that resolves CVE-2026-64046 and reboot."

Remediation

1. Patch the kernel. CVE-2026-64046 is a kernel bug — the only complete fix is a patched kernel. Track your distribution's security tracker for the fixed kernel package (Ubuntu USN, Red Hat RHSA, Debian DSA, SUSE SUSE-SU) referencing CVE-2026-64046 or ZDI-26-701, then schedule reboots. Kernel patches without reboots leave you exposed — livepatch coverage should be confirmed explicitly for this CVE if you rely on kpatch/live patching.
2. Reduce attack surface via module blocklisting. On hosts with no legitimate kTLS workload, blocklist the tls module (/etc/modprobe.d/blocklist-ktls.conf). This prevents the vulnerable code path from being reachable at all. Validate no application depends on it first (nginx ssl_ktls on;, NVMe-TCP with TLS, in-kernel SMB).
3. Enforce least privilege. The precondition is high-privileged local code execution. Audit where root-equivalent access exists: sudo rules, container escapes, CAP_SYS_ADMIN/CAP_NET_ADMIN grants, and overly permissive service accounts. Every removed privilege path removes a trigger for this bug.
4. Baseline kTLS consumers. Build an inventory of which hosts legitimately use kernel TLS so your detections (above) fire on deviations rather than noise.
5. Monitor the advisory. Watch the ZDI advisory page (http://www.zerodayinitiative.com/advisories/ZDI-26-701/) and CISA KEV for status changes — if a PoC publishes or KEV listing occurs, escalate patching priority immediately.
6. Defense in depth for leaked memory. Assume kernel info-leaks will be chained. Keep KASLR enabled (kptr_restrict=2, dmesg_restrict=1), enable kernel lockdown mode in confidentiality where feasible (/sys/kernel/security/lockdown), and enforce secure boot.

There is no CISA KEV deadline for this CVE at the time of writing. Our recommendation: patch within your standard medium-severity kernel window (30 days), compressed to 14 days for internet-facing or multi-tenant hosts running kTLS workloads.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub