{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26585", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.125Z", "datePublished": "2024-02-21T14:59:13.088Z", "dateUpdated": "2026-08-05T11:26:04.351Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:04.351Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it's\nthe inverse order of what the submitting thread will do." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The flaw is in the net/tls software TX path of a kTLS-terminating server, where the encrypt-then-close sequence is driven entirely by remote client traffic (request eliciting a response plus `Connection: close`/RST), and the remote peer additionally controls whether records stay queued at the head of tx_list via its TCP receive window, which is the precondition for reaching the post-complete() code. No local access to the target is needed.\nAC:L - The attacker controls both sides of the race — one side issues the sendmsg that leaves an async encryption in flight, the other issues the close that blocks in tls_encrypt_async_wait() and then frees ctx — and can retry across thousands of concurrent connections at no cost. No memory layout or victim state outside the attacker's influence is required.\nPR:N - A kTLS-offloading HTTPS server accepts connections from arbitrary unauthenticated clients with no client certificate in the typical deployment; locally, setsockopt(TCP_ULP,\"tls\") plus TLS_TX requires no capability at all once the tls module is loaded. Neither path needs an account or privilege on the target.\nUI:N - The race fires during ordinary kTLS record encryption and socket teardown on an established connection. No action by any local user or administrator is required.\nS:U - The use-after-free on struct tls_sw_context_tx and the resulting timer/workqueue corruption all occur in kernel memory managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - After kfree(ctx) the callback and the later timer expiry re-read freed, attacker-groomable memory — timer->function, dwork->wq, and tx_work->sk, the last of which is dereferenced as a struct sock * by tx_work_handler/tls_tx_records. Controlling that fake sock and the redirected call is leverageable into arbitrary kernel memory disclosure.\nI:H - The stale callback performs an atomic bit-set into the reallocated slab object at a fixed offset and writes dwork->wq, dwork->cpu and timer->expires into freed memory, then links that freed object into the global timer wheel. That yields a controlled heap write plus a function pointer read from reclaimed memory, i.e. a control-flow hijack primitive.\nA:H - Arming a delayed_work inside a freed slab object after cancel_delayed_work_sync() reliably produces slab and timer-wheel corruption, and tx_work_handler running against an already-freed TLS context oopses on the stale sk. Any of these panics the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tls/tls_sw.c" ], "versions": [ { "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221", "lessThan": "dd32621f19243f89ce830919496a5dcc2158aa33", "status": "affected", "versionType": "git" }, { "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221", "lessThan": "196f198ca6fce04ba6ce262f5a0e4d567d7d219d", "status": "affected", "versionType": "git" }, { "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221", "lessThan": "6db22d6c7a6dc914b12c0469b94eb639b6a8a146", "status": "affected", "versionType": "git" }, { "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221", "lessThan": "e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57", "status": "affected", "versionType": "git" }, { "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221", "lessThan": "e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tls/tls_sw.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.7.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/dd32621f19243f89ce830919496a5dcc2158aa33" }, { "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d" }, { "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146" }, { "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57" }, { "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb" } ], "title": "tls: fix race between tx work scheduling and socket close", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-28T17:07:29.305466Z", "id": "CVE-2024-26585", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T17:07:36.266Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T18:29:48.732Z" } } ] } }