Linux kernel net/tls use-after-free in tls_do_encryption() -EBUSY error path

CVE-2026-31533 is a use-after-free vulnerability in the Linux kernel net/tls subsystem, specifically in the -EBUSY error path of tls_do_encryption(). The bug was introduced by commit 859054147318 ("net: tls: handle backlogging of crypto requests"). When crypto_aead_encrypt() returns -EBUSY, the encryption request is queued to the cryptd backlog and later completed asynchronously via tls_encrypt_done(). That callback restores the scatterlist entry fields (sge->offset and sge->length) and decrements ctx->encrypt_pending. If tls_encrypt_async_wait() subsequently returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup a second time, causing double restoration of the scatterlist state and a double-decrement of ctx->encrypt_pending. Because encrypt_pending is used as a sentinel initialized to 1, the double-decrement corrupts the pending-operation state and can cause future waits for asynchronous callbacks to be skipped. A subsequent sendmsg path can then free the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still outstanding, leading to a use-after-free when the callback later executes against the freed record.