CVE-2024-26800

Summary

CVE-2024-26800 is a vulnerability affecting the Linux kernel's Transport Layer Security (TLS) module. This issue arises when the TLS decryption process fails with the error code -EBUSY. In such cases, the Linux kernel assumes that all asynchronous decryptions have completed and releases the corresponding pages. However, these pages have already been passed to the async callback, leading to a use-after-free condition. This vulnerability can result in memory corruption and potential security exploits. The issue has been resolved by properly notifying the TLS decryption subsystem when memory has been released during asynchronous decryption.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.