CRITICAL Public exploit Introduced in 5.7
TLS AsyncNotify Race
CVE-2024-26583
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.
02KernelScan AI Analysis
Risk summary
An affected kernel can access freed TLS state when socket closure overlaps asynchronous encryption or decryption completion, causing a panic and potentially corrupting kernel memory. The path can be exercised through unprivileged TLS socket activity and by services processing attacker-controlled network traffic.
Vulnerability analysis
Asynchronous TLS encryption or decryption could wake the socket I/O thread while its crypto completion callback still needed the socket's TLS state; a concurrent close could then free that state and leave the callback accessing kernel memory after release. The fix keeps an additional atomic ownership reference for the submitting thread and signals completion only at the controlled final reference transition, so teardown remains blocked while post-completion callback work is in progress. The path requires an async-capable TLS crypto operation and overlapping send or receive and close activity; it is reachable without special privilege through normal TLS socket use, and a remote peer can exercise it when an application processes attacker-controlled TLS traffic and closes the connection.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.7 | 5.15.160 | 86dc27ee36f5 |
| 5.4 | 5.4.44 | 5.5 | f17d21ea7391 |
| 5.6 | 5.6.16 | 5.7 | 7a3ca06d04d5 |
| 6.1 | 5.7 | 6.1.79 | 6209319b2efd |
| 6.6 | 5.7 | 6.6.18 | aec7961916f3 |
| 6.7 | 5.7 | 6.7.6 | — |
| mainline | 5.7 | 6.8 | — |
| cip/6.1 | 5.7 | 6.1.80-cip16 | 7a3ca06d04d5 |
| cip/6.1-rt | 5.7 | 6.1.80-cip16-rt9 | 7a3ca06d04d5 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.1 | Fixed in 6.1.80-cip16 |
| cip/6.1-rt | Fixed in 6.1.80-cip16-rt9 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |