CVE-2024-26584

What it actually does

Improper handling of -EBUSY returns from crypto_aead_encrypt/decrypt when CRYPTO_TFM_REQ_MAY_BACKLOG is set causes duplicate async callbacks or unhandled errors in the TLS layer, leading to kernel instability or crash.

Why it matters to the business

Local users on affected Linux systems can trigger denial of service against TLS-encrypted network traffic under load, causing service outages without remote access or elevated privileges.

How an attack unfolds

An attacker with local access triggers full cryptd queues for AESNI via sustained TLS operations, forcing backlog enqueuing; mishandled callbacks then corrupt state and crash the kernel.

How to fix it

Upgrade the Linux kernel to the commit 3ade391adc584f17b5570fd205de3ad029090368 or later stable releases containing the tls_*crypt_async_wait helpers and EBUSY-to-EINPROGRESS conversion.

How to confirm the fix worked

Verify the running kernel git commit or version contains 3ade391adc584f17b5570fd205de3ad029090368; test TLS workloads under artificial cryptd queue pressure to confirm no duplicate callbacks occur.

Typical attack path

1. Obtain local user access on target system
2. Generate sustained TLS traffic to fill cryptd queue
3. Force -EBUSY returns from crypto API
4. Trigger duplicate callback handling failure
5. Cause kernel panic or TLS subsystem DoS

How to detect it

Review kernel logs for TLS crypto callback anomalies, repeated -EINPROGRESS after backlog processing, or crashes in net/tls code paths; correlate with high cryptd queue utilization events.

What your security team should do

• Prioritize kernel upgrades on systems exposing TLS sockets
• Monitor for local-user DoS attempts via audit logs
• Apply the fix across all stable branches containing the vulnerable TLS code
• Reassess after 30-day EPSS trend remains low