CVE-2024-26582

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the TLS (Transport Layer Security) implementation within the net/tls/tls sw.c module. The problem occurs because the tls decrypt sg() function fails to take a reference on the pages from clear skb. Consequently, the put page() function within tls decrypt done() releases these pages prematurely. This leads to a use-after-free condition in the process rx list() function when attempting to read from a partially-read skb (socket buffer). This flaw can impact the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.