GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26800 (GCVE-0-2024-26800)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-08-05 11:27
VLAI
Title
tls: fix use-after-free on failed backlog decryption
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-31 20:01 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cd1bbca03f3c1d845ce274c0d0a66de8e5929f72 , < f2b85a4cc763841843de693bbd7308fe9a2c4c89 (git)
Affected: 13eca403876bbea3716e82cdfe6f1e6febb38754 , < 81be85353b0f5a7b660635634b655329b429eefe (git)
Affected: ab6397f072e5097f267abf5cb08a8004e6b17694 , < 1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 (git)
Affected: 8590541473188741055d27b955db0777569438e3 , < 13114dc5543069f7b97991e3b79937b6da05f5b0 (git)
Affected: 3ade391adc584f17b5570fd205de3ad029090368 (git)
Affected: 5.15.160 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.18 , < 6.6.21 (semver)
Affected: 6.7.6 , < 6.7.9 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-31T20:01:08.576744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T20:01:16.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2b85a4cc763841843de693bbd7308fe9a2c4c89",
              "status": "affected",
              "version": "cd1bbca03f3c1d845ce274c0d0a66de8e5929f72",
              "versionType": "git"
            },
            {
              "lessThan": "81be85353b0f5a7b660635634b655329b429eefe",
              "status": "affected",
              "version": "13eca403876bbea3716e82cdfe6f1e6febb38754",
              "versionType": "git"
            },
            {
              "lessThan": "1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1",
              "status": "affected",
              "version": "ab6397f072e5097f267abf5cb08a8004e6b17694",
              "versionType": "git"
            },
            {
              "lessThan": "13114dc5543069f7b97991e3b79937b6da05f5b0",
              "status": "affected",
              "version": "8590541473188741055d27b955db0777569438e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ade391adc584f17b5570fd205de3ad029090368",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.160",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.21",
              "status": "affected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7.9",
              "status": "affected",
              "version": "6.7.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.7.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.160",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix use-after-free on failed backlog decryption\n\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\nreturns -EBUSY, tls_do_decryption will wait until all async\ndecryptions have completed. If one of them fails, tls_do_decryption\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\nreleasing all the pages. But the pages have been passed to the async\ncallback, and have already been released by tls_decrypt_done.\n\nThe only true async case is when crypto_aead_decrypt returns\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\ntls_sw_recvmsg that the data is available for immediate copy, but we\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\nmemory has already been released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered entirely by TLS records arriving from the remote peer on a kTLS (net/tls TLS_SW) socket \u2014 a corrupted AEAD tag produces the -EBADMSG that drives the double-free path, and record volume drives the crypto backlog. No local access is needed.\nAC:L - The attacker controls both required conditions: flooding TLS records across connections saturates the crypto backlog to force -EBUSY, and a single record with a bad GCM tag deterministically forces -EBADMSG, after which the error path unconditionally re-frees memory the completion callback already released.\nPR:N - kTLS is armed after a userspace TLS handshake, and typical kTLS servers (nginx/OpenSSL TLS termination) accept unauthenticated clients with no client certificate, so any anonymous remote peer can drive the vulnerable receive path.\nUI:N - The victim socket is processed by the server\u0027s normal recvmsg loop; no action by a local user or administrator is required.\nS:U - The double-free and page refcount underflow corrupt kernel heap and page state within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The duplicated put_page() underflows the refcount of pages pinned from the user\u0027s recvmsg buffer, so a page still mapped into the process can be reallocated to the kernel and read directly; the slab double-free of the aead_req/dctx block additionally enables freelist-based disclosure.\nI:H - A double-free of an attacker-size-influenced kmalloc object gives SLUB freelist corruption, and the underflowed user-mapped page yields a write primitive into reallocated kernel memory \u2014 both are standard routes to arbitrary write and control-flow hijack.\nA:H - The double kfree() and page refcount underflow reliably corrupt allocator state, producing BUG/KASAN splats, oopses, and kernel panics, and the condition can be re-triggered repeatedly by a remote peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:21.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89"
        },
        {
          "url": "https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0"
        }
      ],
      "title": "tls: fix use-after-free on failed backlog decryption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26800",
    "datePublished": "2024-04-04T08:20:28.554Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2026-08-05T11:27:21.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26800",
      "date": "2026-09-16",
      "epss": "0.00739",
      "percentile": "0.52824"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6.18\", \"versionEndExcluding\": \"6.6.21\", \"matchCriteriaId\": \"29C1AFCE-3BE5-4E3A-9EB4-4BD2E24E28C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7.6\", \"versionEndExcluding\": \"6.7.9\", \"matchCriteriaId\": \"9ADD2879-4CBE-4429-88AE-A23574F0F4AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9F4EA73-0894-400F-A490-3A397AB7A517\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"056BD938-0A27-4569-B391-30578B309EE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"F02056A5-B362-4370-9FF8-6F0BD384D520\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"A780F817-2A77-4130-A9B7-5C25606314E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix use-after-free on failed backlog decryption\\n\\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\\nreturns -EBUSY, tls_do_decryption will wait until all async\\ndecryptions have completed. If one of them fails, tls_do_decryption\\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\\nreleasing all the pages. But the pages have been passed to the async\\ncallback, and have already been released by tls_decrypt_done.\\n\\nThe only true async case is when crypto_aead_decrypt returns\\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\\ntls_sw_recvmsg that the data is available for immediate copy, but we\\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\\nmemory has already been released.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: tls: corrige el use-after-free en el descifrado fallido del trabajo pendiente Cuando la solicitud de descifrado va al trabajo pendiente y crypto_aead_decrypt devuelve -EBUSY, tls_do_decryption esperar\\u00e1 hasta que se hayan completado todos los descifrados as\\u00edncronos. Si uno de ellos falla, tls_do_decryption devolver\\u00e1 -EBADMSG y tls_decrypt_sg salta a la ruta del error, liberando todas las p\\u00e1ginas. Pero las p\\u00e1ginas se pasaron a la devoluci\\u00f3n de llamada as\\u00edncrona y tls_decrypt_done ya las public\\u00f3. El \\u00fanico caso as\\u00edncrono verdadero es cuando crypto_aead_decrypt devuelve -EINPROGRESS. Con -EBUSY, ya esperamos para poder decirle a tls_sw_recvmsg que los datos est\\u00e1n disponibles para copia inmediata, pero debemos notificar a tls_decrypt_sg (a trav\\u00e9s del nuevo indicador -\u0026gt;async_done) que la memoria ya ha sido liberada.\"}]",
      "id": "CVE-2024-26800",
      "lastModified": "2024-12-20T15:55:10.150",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-04-04T09:15:09.003",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26800\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:09.003\",\"lastModified\":\"2026-08-04T11:17:06.557\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix use-after-free on failed backlog decryption\\n\\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\\nreturns -EBUSY, tls_do_decryption will wait until all async\\ndecryptions have completed. If one of them fails, tls_do_decryption\\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\\nreleasing all the pages. But the pages have been passed to the async\\ncallback, and have already been released by tls_decrypt_done.\\n\\nThe only true async case is when crypto_aead_decrypt returns\\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\\ntls_sw_recvmsg that the data is available for immediate copy, but we\\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\\nmemory has already been released.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tls: corrige el use-after-free en el descifrado fallido del trabajo pendiente Cuando la solicitud de descifrado va al trabajo pendiente y crypto_aead_decrypt devuelve -EBUSY, tls_do_decryption esperar\u00e1 hasta que se hayan completado todos los descifrados as\u00edncronos. Si uno de ellos falla, tls_do_decryption devolver\u00e1 -EBADMSG y tls_decrypt_sg salta a la ruta del error, liberando todas las p\u00e1ginas. Pero las p\u00e1ginas se pasaron a la devoluci\u00f3n de llamada as\u00edncrona y tls_decrypt_done ya las public\u00f3. El \u00fanico caso as\u00edncrono verdadero es cuando crypto_aead_decrypt devuelve -EINPROGRESS. Con -EBUSY, ya esperamos para poder decirle a tls_sw_recvmsg que los datos est\u00e1n disponibles para copia inmediata, pero debemos notificar a tls_decrypt_sg (a trav\u00e9s del nuevo indicador -\u0026gt;async_done) que la memoria ya ha sido liberada.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\",\"lessThan\":\"f2b85a4cc763841843de693bbd7308fe9a2c4c89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13eca403876bbea3716e82cdfe6f1e6febb38754\",\"lessThan\":\"81be85353b0f5a7b660635634b655329b429eefe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab6397f072e5097f267abf5cb08a8004e6b17694\",\"lessThan\":\"1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8590541473188741055d27b955db0777569438e3\",\"lessThan\":\"13114dc5543069f7b97991e3b79937b6da05f5b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3ade391adc584f17b5570fd205de3ad029090368\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.160\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.18\",\"lessThan\":\"6.6.21\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.6\",\"lessThan\":\"6.7.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-31T20:01:08.576744Z\",\"id\":\"CVE-2024-26800\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.160\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"FBFB22A0-F353-4425-BB06-D5A6960F3CAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.18\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"29C1AFCE-3BE5-4E3A-9EB4-4BD2E24E28C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.6\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"9ADD2879-4CBE-4429-88AE-A23574F0F4AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:17+00:00",
      "cve": "CVE-2024-26800",
      "id": "CVE-2024-26800",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tls: fix use-after-free on failed backlog decryption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26800.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T01:58:15Z",
      "cve": "CVE-2024-26800",
      "id": "CVE-2024-26800",
      "initial_release_date": "2024-04-13T02:10:37Z",
      "product_status:known_affected": "292",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "763",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26800",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26800.json",
      "version": "73"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.534Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26800\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-31T20:01:08.576744Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-31T20:01:12.999Z\"}}], \"cna\": {\"title\": \"tls: fix use-after-free on failed backlog decryption\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is triggered entirely by TLS records arriving from the remote peer on a kTLS (net/tls TLS_SW) socket \\u2014 a corrupted AEAD tag produces the -EBADMSG that drives the double-free path, and record volume drives the crypto backlog. No local access is needed.\\nAC:L - The attacker controls both required conditions: flooding TLS records across connections saturates the crypto backlog to force -EBUSY, and a single record with a bad GCM tag deterministically forces -EBADMSG, after which the error path unconditionally re-frees memory the completion callback already released.\\nPR:N - kTLS is armed after a userspace TLS handshake, and typical kTLS servers (nginx/OpenSSL TLS termination) accept unauthenticated clients with no client certificate, so any anonymous remote peer can drive the vulnerable receive path.\\nUI:N - The victim socket is processed by the server\u0027s normal recvmsg loop; no action by a local user or administrator is required.\\nS:U - The double-free and page refcount underflow corrupt kernel heap and page state within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - The duplicated put_page() underflows the refcount of pages pinned from the user\u0027s recvmsg buffer, so a page still mapped into the process can be reallocated to the kernel and read directly; the slab double-free of the aead_req/dctx block additionally enables freelist-based disclosure.\\nI:H - A double-free of an attacker-size-influenced kmalloc object gives SLUB freelist corruption, and the underflowed user-mapped page yields a write primitive into reallocated kernel memory \\u2014 both are standard routes to arbitrary write and control-flow hijack.\\nA:H - The double kfree() and page refcount underflow reliably corrupt allocator state, producing BUG/KASAN splats, oopses, and kernel panics, and the condition can be re-triggered repeatedly by a remote peer.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\", \"lessThan\": \"f2b85a4cc763841843de693bbd7308fe9a2c4c89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13eca403876bbea3716e82cdfe6f1e6febb38754\", \"lessThan\": \"81be85353b0f5a7b660635634b655329b429eefe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ab6397f072e5097f267abf5cb08a8004e6b17694\", \"lessThan\": \"1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8590541473188741055d27b955db0777569438e3\", \"lessThan\": \"13114dc5543069f7b97991e3b79937b6da05f5b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3ade391adc584f17b5570fd205de3ad029090368\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.160\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6.18\", \"lessThan\": \"6.6.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.6\", \"lessThan\": \"6.7.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\"}, {\"url\": \"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\"}, {\"url\": \"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\"}, {\"url\": \"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix use-after-free on failed backlog decryption\\n\\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\\nreturns -EBUSY, tls_do_decryption will wait until all async\\ndecryptions have completed. If one of them fails, tls_do_decryption\\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\\nreleasing all the pages. But the pages have been passed to the async\\ncallback, and have already been released by tls_decrypt_done.\\n\\nThe only true async case is when crypto_aead_decrypt returns\\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\\ntls_sw_recvmsg that the data is available for immediate copy, but we\\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\\nmemory has already been released.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.7.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.15.160\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:21.641Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26800\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:21.641Z\", \"dateReserved\": \"2024-02-19T14:20:24.179Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:28.554Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.