CVE-2024-26583

2024-02-2215:02:03

redhat.com

access.redhat.com

cve-2024-26583

race condition

linux kernel

tls subsystem

use-after-free

denial of service

kernel up-to-date

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete(); any code past that point risks touching already freed data. This could lead to a use-after-free issue and a denial of service condition.

Mitigation

No current mitigation is available for this vulnerability. Please make sure to have kernel up-to-date as soon as the patches are available to make sure the flaw mitigated.