CVE-2024-26582

Summary

CVE-2024-26582 is a newly identified vulnerability in the Linux kernel. This issue revolves around the net subsystem's TLS decryption process, where a use-after-free condition arises due to improper handling of memory. Specifically, the function tls_decrypt_sg fails to retain a reference on the pages from clear_skb. Consequently, when put_page() in tls_decrypt_done releases these pages, an attempt to read from the partially-read skb results in use-after-free, posing a potential security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.