CVE-2024-26582

What it actually does

Use-after-free in the Linux kernel TLS decryption path where tls_decrypt_sg fails to hold references on pages from clear_skb, allowing put_page in tls_decrypt_done to free memory that process_rx_list later accesses on partial reads with async decrypt.

Why it matters to the business

Linux systems performing TLS network operations face risk of local memory corruption that can lead to crashes or full system compromise, affecting servers and devices running affected kernels; low immediate urgency given absence from known exploited lists and stable low exploit probability.

How an attack unfolds

An attacker with local access crafts TLS traffic that triggers partial skb reads combined with asynchronous decryption, causing the kernel to reference freed pages during receive processing and enabling memory corruption or code execution in the kernel context.

How to fix it

Update the Linux kernel to a version containing commit 20b4ed034872b4d024b26e2bc1092c3f80e5db96 or later stable releases that resolve the TLS use-after-free; rebuild and deploy the patched kernel across all affected systems, then reboot to activate the fix.

How to confirm the fix worked

Confirm the running kernel includes commit 20b4ed034872b4d024b26e2bc1092c3f80e5db96 via git log or version strings; test TLS decryption under partial-read and async conditions to verify no use-after-free occurs.

Typical attack path

1. Obtain local access or execute code on a vulnerable Linux system
2. Send or induce TLS traffic that forces partial reads under async decrypt conditions
3. Trigger tls_decrypt_done to release pages while process_rx_list still holds references
4. Perform follow-on operations that read or write the freed memory for corruption or escalation

How to detect it

Review kernel logs and audit trails for TLS receive path crashes or warnings around skb handling; correlate with process activity involving TLS sockets and async crypto operations on unpatched systems.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all production Linux hosts handling TLS
• Monitor kernel update channels for backports to supported distribution branches
• Review and restrict local user access on systems exposing TLS endpoints until patched
• Incorporate kernel version checks into regular vulnerability scanning workflows