CVE-2024-26583

Summary

CVE-2024-26583 is a vulnerability affecting the Linux kernel that has been addressed. It involves a race condition between async notification and socket close in the tls subsystem. The submitting thread, which may call recvmsg or sendmsg, could exit before the async crypto handler completes, resulting in attempts to access already freed data. To mitigate this issue, the main thread should hold an extra reference to avoid relying on locks and flags for synchronization. Additionally, efforts to reinitiate the completion have been discouraged, as the developers are now implementing stricter control over when completion fires.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.