CVE-2024-26585: tls: fix race between tx work scheduling and socket close
In the Linux kernel, the following vulnerability has been resolved:
tls: fix race between tx work scheduling and socket close
Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a race condition when submitting thread in the tls subsystem. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26585?
CVE-2024-26585 has been classified with moderate severity due to its potential impact on system stability.
How do I fix CVE-2024-26585?
To address CVE-2024-26585, you should upgrade to a fixed version of the Linux kernel, specifically versions 6.8 or greater.
What systems are affected by CVE-2024-26585?
CVE-2024-26585 affects various Linux kernel versions between 4.20.0 and 6.7.6 as well as specific Red Hat and Debian packages.
When was CVE-2024-26585 disclosed?
CVE-2024-26585 was disclosed in 2024, highlighting a race condition issue in the Linux kernel.
Can CVE-2024-26585 cause data loss?
While CVE-2024-26585 primarily affects system functionality, it may lead to unexpected behavior that could indirectly risk data integrity.