CVE-2024-26582

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26582
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26582.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26582
Downstream
Related
Published
2024-02-21T14:59:11Z
Modified
2026-08-12T03:51:13Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
net: tls: fix use-after-free with partial reads and async decrypt
Details

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix use-after-free with partial reads and async decrypt

tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26582.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fd31f3996af2627106e22a9f8072764fede51161
Fixed
20b4ed034872b4d024b26e2bc1092c3f80e5db96
Fixed
d684763534b969cca1022e2a28645c7cc91f7fa5
Fixed
754c9bab77a1b895b97bd99d754403c505bc79df
Fixed
32b55c5ff9103b8508c1e04bfa5a08c64e7a925f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26582.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.1.79
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.18
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26582.json"