What’s Vulnerable › Vulnerabilities

CVE-2024-26582: net: tls: fix use-after-free with partial reads and async decrypt

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-21 · updated 2026-08-04
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb.

Affected products

• Linux kernel: from 6.0 before 6.1.79; from 6.2.0 before 6.6.18; from 6.7.0 before 6.7.6 — fixed in 6.1.79, 6.6.18, 6.7.6

How to fix

Upgrade to a fixed version: Linux kernel 6.1.79, 6.6.18, 6.7.6. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/20b4ed034872b4d024b26e2bc1092c3f80e5db96
• https://git.kernel.org/stable/c/32b55c5ff9103b8508c1e04bfa5a08c64e7a925f
• https://git.kernel.org/stable/c/754c9bab77a1b895b97bd99d754403c505bc79df
• https://git.kernel.org/stable/c/d684763534b969cca1022e2a28645c7cc91f7fa5
• https://git.kernel.org/stable/c/20b4ed034872b4d024b26e2bc1092c3f80e5db96
• https://git.kernel.org/stable/c/32b55c5ff9103b8508c1e04bfa5a08c64e7a925f
• https://git.kernel.org/stable/c/754c9bab77a1b895b97bd99d754403c505bc79df
• https://git.kernel.org/stable/c/d684763534b969cca1022e2a28645c7cc91f7fa5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/

Get alerted when CVE-2024-26582 or the next vulnerability affects your stack