CVE-2024-26584 (GCVE-0-2024-26584)

Vulnerability from cvelistv5 – Published: 2024-02-21 14:59 – Updated: 2026-08-05 11:26
VLAI
Title
net: tls: handle backlogging of crypto requests
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0. Compared to Sabrina's original patch this version uses the new tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a54667f6728c2714a400f3c884727da74b6d1717 , < 3ade391adc584f17b5570fd205de3ad029090368 (git)
Affected: a54667f6728c2714a400f3c884727da74b6d1717 , < cd1bbca03f3c1d845ce274c0d0a66de8e5929f72 (git)
Affected: a54667f6728c2714a400f3c884727da74b6d1717 , < 13eca403876bbea3716e82cdfe6f1e6febb38754 (git)
Affected: a54667f6728c2714a400f3c884727da74b6d1717 , < ab6397f072e5097f267abf5cb08a8004e6b17694 (git)
Affected: a54667f6728c2714a400f3c884727da74b6d1717 , < 8590541473188741055d27b955db0777569438e3 (git)
Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.15.160 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-26T17:14:36.035758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:03.401Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:29:47.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ade391adc584f17b5570fd205de3ad029090368",
              "status": "affected",
              "version": "a54667f6728c2714a400f3c884727da74b6d1717",
              "versionType": "git"
            },
            {
              "lessThan": "cd1bbca03f3c1d845ce274c0d0a66de8e5929f72",
              "status": "affected",
              "version": "a54667f6728c2714a400f3c884727da74b6d1717",
              "versionType": "git"
            },
            {
              "lessThan": "13eca403876bbea3716e82cdfe6f1e6febb38754",
              "status": "affected",
              "version": "a54667f6728c2714a400f3c884727da74b6d1717",
              "versionType": "git"
            },
            {
              "lessThan": "ab6397f072e5097f267abf5cb08a8004e6b17694",
              "status": "affected",
              "version": "a54667f6728c2714a400f3c884727da74b6d1717",
              "versionType": "git"
            },
            {
              "lessThan": "8590541473188741055d27b955db0777569438e3",
              "status": "affected",
              "version": "a54667f6728c2714a400f3c884727da74b6d1717",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.160",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: handle backlogging of crypto requests\n\nSince we\u0027re setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\nthe cryptd queue for AESNI is full (easy to trigger with an\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\nto the backlog but still processed. In that case, the async callback\nwill also be called twice: first with err == -EINPROGRESS, which it\nseems we can just ignore, then with err == 0.\n\nCompared to Sabrina\u0027s original patch this version uses the new\ntls_*crypt_async_wait() helpers and converts the EBUSY to\nEINPROGRESS to avoid having to modify all the error handling\npaths. The handling is identical."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in net/tls software crypto submission, and the decrypt path is driven directly by TLS records received from the remote peer while the encrypt path is driven by data sent back over the same connection. A remote client of a kTLS-terminating server reaches the vulnerable code purely by sending network traffic.\nAC:L - The triggering condition is a full crypto backlog queue, which is a load condition the attacker creates by driving concurrent TLS records across many kTLS sockets; on hardware crypto accelerators with shallow rings, -EBUSY occurs under ordinary attacker-generated throughput. No memory layout or victim state outside the attacker\u0027s influence is required.\nPR:N - A kTLS-offloading server accepts connections from arbitrary unauthenticated clients (no client certificates in the typical deployment), and once the session is established the attacker only needs to send record data. No account or privilege on the target system is required.\nUI:N - The bug triggers automatically during normal kTLS record encryption and decryption on an established connection. No action by any local user or administrator is needed.\nS:U - The use-after-free, double free and page refcount underflow all occur within kernel memory managed by the same security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed tls_rec / aead_req+tls_decrypt_ctx blocks are re-read after being reclaimed, yielding an attacker-groomable sock pointer and scatterlist, and the page refcount underflow from the spurious put_page() lets freed pages holding other tenants\u0027 data be re-observed. This is leverageable into arbitrary kernel memory disclosure.\nI:H - The stale callback writes into freed memory (rec-\u003etx_ready, sge-\u003eoffset, ctx-\u003easync_wait.err) and the crypto engine writes attacker-supplied plaintext into pages already released, giving a controlled-content write primitive, compounded by a double kfree() of the decrypt buffer.\nA:H - The use-after-free, double free and page refcount underflow reliably produce slab corruption and kernel panics, and the encrypt_pending/decrypt_pending underflow leaves tls_*crypt_async_wait() waiting on a completion that never arrives, hanging the socket close path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:03.272Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
        },
        {
          "url": "https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694"
        },
        {
          "url": "https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3"
        }
      ],
      "title": "net: tls: handle backlogging of crypto requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26584",
    "datePublished": "2024-02-21T14:59:12.452Z",
    "dateReserved": "2024-02-19T14:20:24.125Z",
    "dateUpdated": "2026-08-05T11:26:03.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26584",
      "date": "2026-08-05",
      "epss": "0.00746",
      "percentile": "0.513"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T03:02:57.000Z",
      "cve": "CVE-2024-26584",
      "id": "msrc_CVE-2024-26584",
      "initial_release_date": "2024-02-02T08:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: tls: handle backlogging of crypto requests",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26584.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26584\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-21T15:15:09.420\",\"lastModified\":\"2026-06-17T07:17:49.457\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tls: handle backlogging of crypto requests\\n\\nSince we\u0027re setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\\nthe cryptd queue for AESNI is full (easy to trigger with an\\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\\nto the backlog but still processed. In that case, the async callback\\nwill also be called twice: first with err == -EINPROGRESS, which it\\nseems we can just ignore, then with err == 0.\\n\\nCompared to Sabrina\u0027s original patch this version uses the new\\ntls_*crypt_async_wait() helpers and converts the EBUSY to\\nEINPROGRESS to avoid having to modify all the error handling\\npaths. The handling is identical.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tls: manejar el retraso de solicitudes criptogr\u00e1ficas Dado que estamos configurando el indicador CRYPTO_TFM_REQ_MAY_BACKLOG en nuestras solicitudes a la API criptogr\u00e1fica, crypto_aead_{encrypt,decrypt} puede devolver -EBUSY en lugar de - EINPROGRESS en situaciones v\u00e1lidas. Por ejemplo, cuando la cola cryptd para AESNI est\u00e1 llena (f\u00e1cil de activar con un cryptd.cryptd_max_cpu_qlen artificialmente bajo), las solicitudes se pondr\u00e1n en cola en el trabajo pendiente, pero a\u00fan as\u00ed se procesar\u00e1n. En ese caso, la devoluci\u00f3n de llamada as\u00edncrona tambi\u00e9n se llamar\u00e1 dos veces: primero con err == -EINPROGRESS, que parece que podemos ignorar, luego con err == 0. En comparaci\u00f3n con el parche original de Sabrina, esta versi\u00f3n usa el nuevo tls_*crypt_async_wait( ) ayuda y convierte EBUSY a EINPROGRESS para evitar tener que modificar todas las rutas de manejo de errores. El manejo es id\u00e9ntico.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a54667f6728c2714a400f3c884727da74b6d1717\",\"lessThan\":\"3ade391adc584f17b5570fd205de3ad029090368\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a54667f6728c2714a400f3c884727da74b6d1717\",\"lessThan\":\"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a54667f6728c2714a400f3c884727da74b6d1717\",\"lessThan\":\"13eca403876bbea3716e82cdfe6f1e6febb38754\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a54667f6728c2714a400f3c884727da74b6d1717\",\"lessThan\":\"ab6397f072e5097f267abf5cb08a8004e6b17694\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a54667f6728c2714a400f3c884727da74b6d1717\",\"lessThan\":\"8590541473188741055d27b955db0777569438e3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.160\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.84\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.18\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.6\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-02-26T17:14:36.035758Z\",\"id\":\"CVE-2024-26584\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16.0\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"6F1F2625-29D5-4FED-B7F5-6087227ABCB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.0\",\"versionEndExcluding\":\"6.6.18\",\"matchCriteriaId\":\"A5CC150E-F35C-4CF7-ADF5-422D32C511C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.0\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"0C8D1FAD-4D5D-4A25-B058-2AD15082710E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:39+00:00",
      "cve": "CVE-2024-26584",
      "id": "CVE-2024-26584",
      "initial_release_date": "2024-02-21T00:00:00+00:00",
      "product_status:fixed": "929",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "59",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tls: handle backlogging of crypto requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26584.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T18:29:47.526Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26584\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-26T17:14:36.035758Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:37.699Z\"}}], \"cna\": {\"title\": \"net: tls: handle backlogging of crypto requests\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The flaw is in net/tls software crypto submission, and the decrypt path is driven directly by TLS records received from the remote peer while the encrypt path is driven by data sent back over the same connection. A remote client of a kTLS-terminating server reaches the vulnerable code purely by sending network traffic.\\nAC:L - The triggering condition is a full crypto backlog queue, which is a load condition the attacker creates by driving concurrent TLS records across many kTLS sockets; on hardware crypto accelerators with shallow rings, -EBUSY occurs under ordinary attacker-generated throughput. No memory layout or victim state outside the attacker\u0027s influence is required.\\nPR:N - A kTLS-offloading server accepts connections from arbitrary unauthenticated clients (no client certificates in the typical deployment), and once the session is established the attacker only needs to send record data. No account or privilege on the target system is required.\\nUI:N - The bug triggers automatically during normal kTLS record encryption and decryption on an established connection. No action by any local user or administrator is needed.\\nS:U - The use-after-free, double free and page refcount underflow all occur within kernel memory managed by the same security authority. No VM, IOMMU or sandbox boundary is crossed.\\nC:H - The freed tls_rec / aead_req+tls_decrypt_ctx blocks are re-read after being reclaimed, yielding an attacker-groomable sock pointer and scatterlist, and the page refcount underflow from the spurious put_page() lets freed pages holding other tenants\u0027 data be re-observed. This is leverageable into arbitrary kernel memory disclosure.\\nI:H - The stale callback writes into freed memory (rec-\u003etx_ready, sge-\u003eoffset, ctx-\u003easync_wait.err) and the crypto engine writes attacker-supplied plaintext into pages already released, giving a controlled-content write primitive, compounded by a double kfree() of the decrypt buffer.\\nA:H - The use-after-free, double free and page refcount underflow reliably produce slab corruption and kernel panics, and the encrypt_pending/decrypt_pending underflow leaves tls_*crypt_async_wait() waiting on a completion that never arrives, hanging the socket close path.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a54667f6728c2714a400f3c884727da74b6d1717\", \"lessThan\": \"3ade391adc584f17b5570fd205de3ad029090368\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a54667f6728c2714a400f3c884727da74b6d1717\", \"lessThan\": \"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a54667f6728c2714a400f3c884727da74b6d1717\", \"lessThan\": \"13eca403876bbea3716e82cdfe6f1e6febb38754\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a54667f6728c2714a400f3c884727da74b6d1717\", \"lessThan\": \"ab6397f072e5097f267abf5cb08a8004e6b17694\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a54667f6728c2714a400f3c884727da74b6d1717\", \"lessThan\": \"8590541473188741055d27b955db0777569438e3\", \"versionType\": \"git\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368\"}, {\"url\": \"https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72\"}, {\"url\": \"https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754\"}, {\"url\": \"https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694\"}, {\"url\": \"https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tls: handle backlogging of crypto requests\\n\\nSince we\u0027re setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\\nthe cryptd queue for AESNI is full (easy to trigger with an\\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\\nto the backlog but still processed. In that case, the async callback\\nwill also be called twice: first with err == -EINPROGRESS, which it\\nseems we can just ignore, then with err == 0.\\n\\nCompared to Sabrina\u0027s original patch this version uses the new\\ntls_*crypt_async_wait() helpers and converts the EBUSY to\\nEINPROGRESS to avoid having to modify all the error handling\\npaths. The handling is identical.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.160\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:03.272Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26584\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:03.272Z\", \"dateReserved\": \"2024-02-19T14:20:24.125Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-21T14:59:12.452Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.