CVE-2024-26585 (GCVE-0-2024-26585)
Vulnerability from cvelistv5
Published
2024-02-21 14:59
Modified
2026-08-05 11:26
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.
References
Impacted products
Vendor Product Version
Linux Linux Version: a42055e8d2c30d4decfc13ce943d09c7b9dad221
Version: a42055e8d2c30d4decfc13ce943d09c7b9dad221
Version: a42055e8d2c30d4decfc13ce943d09c7b9dad221
Version: a42055e8d2c30d4decfc13ce943d09c7b9dad221
Version: a42055e8d2c30d4decfc13ce943d09c7b9dad221
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T17:07:29.305466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T17:07:36.266Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:29:48.732Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd32621f19243f89ce830919496a5dcc2158aa33",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "196f198ca6fce04ba6ce262f5a0e4d567d7d219d",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "6db22d6c7a6dc914b12c0469b94eb639b6a8a146",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it\u0027s\nthe inverse order of what the submitting thread will do."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the net/tls software TX path of a kTLS-terminating server, where the encrypt-then-close sequence is driven entirely by remote client traffic (request eliciting a response plus `Connection: close`/RST), and the remote peer additionally controls whether records stay queued at the head of tx_list via its TCP receive window, which is the precondition for reaching the post-complete() code. No local access to the target is needed.\nAC:L - The attacker controls both sides of the race \u2014 one side issues the sendmsg that leaves an async encryption in flight, the other issues the close that blocks in tls_encrypt_async_wait() and then frees ctx \u2014 and can retry across thousands of concurrent connections at no cost. No memory layout or victim state outside the attacker\u0027s influence is required.\nPR:N - A kTLS-offloading HTTPS server accepts connections from arbitrary unauthenticated clients with no client certificate in the typical deployment; locally, setsockopt(TCP_ULP,\"tls\") plus TLS_TX requires no capability at all once the tls module is loaded. Neither path needs an account or privilege on the target.\nUI:N - The race fires during ordinary kTLS record encryption and socket teardown on an established connection. No action by any local user or administrator is required.\nS:U - The use-after-free on struct tls_sw_context_tx and the resulting timer/workqueue corruption all occur in kernel memory managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - After kfree(ctx) the callback and the later timer expiry re-read freed, attacker-groomable memory \u2014 timer-\u003efunction, dwork-\u003ewq, and tx_work-\u003esk, the last of which is dereferenced as a struct sock * by tx_work_handler/tls_tx_records. Controlling that fake sock and the redirected call is leverageable into arbitrary kernel memory disclosure.\nI:H - The stale callback performs an atomic bit-set into the reallocated slab object at a fixed offset and writes dwork-\u003ewq, dwork-\u003ecpu and timer-\u003eexpires into freed memory, then links that freed object into the global timer wheel. That yields a controlled heap write plus a function pointer read from reclaimed memory, i.e. a control-flow hijack primitive.\nA:H - Arming a delayed_work inside a freed slab object after cancel_delayed_work_sync() reliably produces slab and timer-wheel corruption, and tx_work_handler running against an already-freed TLS context oopses on the stale sk. Any of these panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:04.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd32621f19243f89ce830919496a5dcc2158aa33"
        },
        {
          "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146"
        },
        {
          "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb"
        }
      ],
      "title": "tls: fix race between tx work scheduling and socket close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26585",
    "datePublished": "2024-02-21T14:59:13.088Z",
    "dateReserved": "2024-02-19T14:20:24.125Z",
    "dateUpdated": "2026-08-05T11:26:04.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T18:29:48.732Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26585\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-28T17:07:29.305466Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-28T17:07:33.584Z\"}}], \"cna\": {\"title\": \"tls: fix race between tx work scheduling and socket close\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The flaw is in the net/tls software TX path of a kTLS-terminating server, where the encrypt-then-close sequence is driven entirely by remote client traffic (request eliciting a response plus `Connection: close`/RST), and the remote peer additionally controls whether records stay queued at the head of tx_list via its TCP receive window, which is the precondition for reaching the post-complete() code. No local access to the target is needed.\\nAC:L - The attacker controls both sides of the race \\u2014 one side issues the sendmsg that leaves an async encryption in flight, the other issues the close that blocks in tls_encrypt_async_wait() and then frees ctx \\u2014 and can retry across thousands of concurrent connections at no cost. No memory layout or victim state outside the attacker\u0027s influence is required.\\nPR:N - A kTLS-offloading HTTPS server accepts connections from arbitrary unauthenticated clients with no client certificate in the typical deployment; locally, setsockopt(TCP_ULP,\\\"tls\\\") plus TLS_TX requires no capability at all once the tls module is loaded. Neither path needs an account or privilege on the target.\\nUI:N - The race fires during ordinary kTLS record encryption and socket teardown on an established connection. No action by any local user or administrator is required.\\nS:U - The use-after-free on struct tls_sw_context_tx and the resulting timer/workqueue corruption all occur in kernel memory managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - After kfree(ctx) the callback and the later timer expiry re-read freed, attacker-groomable memory \\u2014 timer-\u003efunction, dwork-\u003ewq, and tx_work-\u003esk, the last of which is dereferenced as a struct sock * by tx_work_handler/tls_tx_records. Controlling that fake sock and the redirected call is leverageable into arbitrary kernel memory disclosure.\\nI:H - The stale callback performs an atomic bit-set into the reallocated slab object at a fixed offset and writes dwork-\u003ewq, dwork-\u003ecpu and timer-\u003eexpires into freed memory, then links that freed object into the global timer wheel. That yields a controlled heap write plus a function pointer read from reclaimed memory, i.e. a control-flow hijack primitive.\\nA:H - Arming a delayed_work inside a freed slab object after cancel_delayed_work_sync() reliably produces slab and timer-wheel corruption, and tx_work_handler running against an already-freed TLS context oopses on the stale sk. Any of these panics the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a42055e8d2c30d4decfc13ce943d09c7b9dad221\", \"lessThan\": \"dd32621f19243f89ce830919496a5dcc2158aa33\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a42055e8d2c30d4decfc13ce943d09c7b9dad221\", \"lessThan\": \"196f198ca6fce04ba6ce262f5a0e4d567d7d219d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a42055e8d2c30d4decfc13ce943d09c7b9dad221\", \"lessThan\": \"6db22d6c7a6dc914b12c0469b94eb639b6a8a146\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a42055e8d2c30d4decfc13ce943d09c7b9dad221\", \"lessThan\": \"e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a42055e8d2c30d4decfc13ce943d09c7b9dad221\", \"lessThan\": \"e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb\", \"versionType\": \"git\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd32621f19243f89ce830919496a5dcc2158aa33\"}, {\"url\": \"https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d\"}, {\"url\": \"https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146\"}, {\"url\": \"https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57\"}, {\"url\": \"https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix race between tx work scheduling and socket close\\n\\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\\nmay exit as soon as the async crypto handler calls complete().\\nReorder scheduling the work before calling complete().\\nThis seems more logical in the first place, as it\u0027s\\nthe inverse order of what the submitting thread will do.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:04.351Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26585\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:04.351Z\", \"dateReserved\": \"2024-02-19T14:20:24.125Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-21T14:59:13.088Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.