Vulnerability in Linux
CVE-2024-26585
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.
Vulnerability class: Race Condition
EPSS: 0.002 (8.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions a42055e8d2c30d4decfc13ce943d09c7b9dad221, 4.20, 0
- Linux Linux_kernel
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-26585?
- CVE-2024-26585 is a critical-severity vulnerability in Linux, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 9.8/10. Published 2024-02-21.
- How severe is CVE-2024-26585?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-26585 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.