[    4.879867] BUG: KASAN: slab-use-after-free in tls_decrypt_sg+0x2037/0x29c0
[    4.880230] Read of size 8 at addr ff110000025ff9b8 by task init/58
[    4.880230] 
[    4.880230] CPU: 1 PID: 58 Comm: init Not tainted 6.6.18 #8
[    4.880230] Hardware name: QEMU Ubuntu 26.04 PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[    4.880230] Call Trace:
[    4.880230]  <TASK>
[    4.880230]  dump_stack_lvl+0x36/0x50
[    4.880230]  print_report+0xcf/0x660
[    4.880230]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[    4.880230]  ? tls_decrypt_sg+0x2037/0x29c0
[    4.880230]  kasan_report+0xc1/0x100
[    4.880230]  ? tls_decrypt_sg+0x2037/0x29c0
[    4.880230]  tls_decrypt_sg+0x2037/0x29c0
[    4.880230]  ? __pfx_tls_decrypt_sg+0x10/0x10
[    4.880230]  ? tls_strp_msg_load+0x23a/0x660
[    4.880230]  ? tls_rx_rec_wait+0x68e/0x840
[    4.880230]  tls_rx_one_record+0xd6/0xca0
[    4.880230]  ? __pfx_tls_rx_one_record+0x10/0x10
[    4.880230]  ? read_hpet+0x142/0x1e0
[    4.880230]  tls_sw_recvmsg+0x721/0x17b0
[    4.880230]  ? _raw_write_unlock_irq+0x1/0x60
[    4.880230]  ? __pfx_tls_sw_recvmsg+0x10/0x10
[    4.880230]  ? _raw_spin_lock_irqsave+0x10/0xe0
[    4.880230]  inet_recvmsg+0x355/0x4f0
[    4.880230]  ? _raw_spin_lock+0x7f/0xe0
[    4.880230]  ? __pfx_inet_recvmsg+0x10/0x10
[    4.880230]  ? security_socket_recvmsg+0x6f/0xb0
[    4.880230]  sock_recvmsg+0x16d/0x220
[    4.880230]  ? sockfd_lookup_light+0x11/0x180
[    4.880230]  __sys_recvfrom+0x18e/0x2a0
[    4.880230]  ? __pfx___sys_recvfrom+0x10/0x10
[    4.880230]  ? ksys_write+0xff/0x210
[    4.880230]  __x64_sys_recvfrom+0xdf/0x1f0
[    4.880230]  ? exit_to_user_mode_prepare+0x27/0x120
[    4.880230]  ? syscall_exit_to_user_mode+0x2f/0x50
[    4.880230]  ? __pfx___x64_sys_recvfrom+0x10/0x10
[    4.880230]  do_syscall_64+0x3f/0x90
[    4.880230]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[    4.880230] RIP: 0033:0x4519d6
[    4.880230] Code: 47 ba 04 00 00 00 48 c7 c0 f0 ff ff ff 64 89 10 48 c7 c2 ff ff ff ff c9 48 89 d0 c3 0f 1f 84 00 00 00 00 00 48 8b 45 10 0f 05 <48> 89 c2 48 3d 00 f0 ff ff 77 0f c9 48 89 d0 c3 66 2e 0f 1f 84 00
[    4.880230] RSP: 002b:00007ffd30525ca0 EFLAGS: 00000202 ORIG_RAX: 000000000000002d
[    4.880230] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00000000004519d6
[    4.880230] RDX: 0000000000010000 RSI: 000000000109c6d0 RDI: 0000000000000005
[    4.880230] RBP: 00007ffd30525cb0 R08: 0000000000000000 R09: 0000000000000000
[    4.880230] R10: 0000000000000100 R11: 0000000000000202 R12: 0000000000000003
[    4.880230] R13: 00007ffd30525ee8 R14: 0000000000000005 R15: 0000000000000000
[    4.880230]  </TASK>
[    4.880230] 
[    4.880230] Allocated by task 58:
[    4.880230]  kasan_save_stack+0x30/0x60
[    4.880230]  kasan_set_track+0x25/0x30
[    4.880230]  __kasan_kmalloc+0x7f/0x90
[    4.880230]  __kmalloc+0x5f/0x140
[    4.880230]  tls_decrypt_sg+0x5c8/0x29c0
[    4.880230]  tls_rx_one_record+0xd6/0xca0
[    4.880230]  tls_sw_recvmsg+0x721/0x17b0
[    4.880230]  inet_recvmsg+0x355/0x4f0
[    4.880230]  sock_recvmsg+0x16d/0x220
[    4.880230]  __sys_recvfrom+0x18e/0x2a0
[    4.880230]  __x64_sys_recvfrom+0xdf/0x1f0
[    4.880230]  do_syscall_64+0x3f/0x90
[    4.880230]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[    4.880230] 
[    4.880230] Freed by task 26:
[    4.880230]  kasan_save_stack+0x30/0x60
[    4.880230]  kasan_set_track+0x25/0x30
[    4.880230]  kasan_save_free_info+0x2b/0x50
[    4.880230]  __kasan_slab_free+0x109/0x180
[    4.880230]  __kmem_cache_free+0x85/0x1c0
[    4.880230]  tls_decrypt_done+0x182/0x3f0
[    4.880230]  cryptd_aead_crypt+0x386/0x6f0
[    4.880230]  cryptd_queue_worker+0x110/0x1d0
[    4.880230]  process_one_work+0x544/0xce0