CVE-2024-26583

MediumCVSS 4.7/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tls: fix race between async notify and socket close

The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data.

Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization.

Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-265845.5In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting thCVE-2024-265854.7In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly toCVE-2024-265866.7In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are firCVE-2024-265875.5In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized iCVE-2024-265887.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test CVE-2024-265897.8In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KECVE-2024-26597.2A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execCVE-2024-265905.5In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select cCVE-2024-265915.5In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The followingCVE-2024-265927.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is betweenCVE-2024-265937.1In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel CVE-2024-265947.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mec
CVE-2024-26583: Medium severity, CVSS 4.7 | Vulnix