CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved:

net: tls: prevent chain-after-chain in plain text SG

Sashiko points out that if end = 0 (start != 0) the current

code will create a chain link to content type right after

the wrap link:

This would create a chain where the wrap link points directly

to another chain link. The scatterlist API sg_next iterator

does not recursively resolve consecutive chain links.

meaning this is illegal input to crypto.

The wrapping link is unnecessary if end = 0. end is the entry after

the last one used so end = 0 means there's nothing pushed after

the wrap:

end start i

v v v

[ ]...[ ][ d ][ d ][ d ][ d ][rsv for wrap]

Skip the wrapping in this case.

TLS 1.3 can use the "wrapping slot" for it's chaining if end = 0.

This avoids the chain-after-chain.

Move the wrap chaining before marking END and chaining off content

type, that feels like more logical ordering to me, but should not

matter from functional perspective.