CVE-2024-58239

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tls: stop recv() if initial process_rx_list gave us non-DATA

If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them: - process_rx_list copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA

Just check the record type and jump to the end in case process_rx_list did some work.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 22, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-58247.4A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite thCVE-2024-582407.8In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we'reCVE-2024-582415.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make useCVE-2024-582483.5nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cardsCVE-2024-582493.7In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.CVE-2024-582509.3The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.CVE-2024-582512.5In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequeCVE-2024-582525.5Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may aCVE-2024-582532.9In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversionCVE-2024-582556.7EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.CVE-2024-582567.8EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.CVE-2024-582576.7EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.
CVE-2024-58239: Medium severity, CVSS 5.5 | Vulnix