CVE-2024-26800

A flaw was found in the Linux kernel's Transport Layer Security (TLS) subsystem. When an asynchronous decryption request fails during backlog processing, the kernel mishandles memory cleanup and accesses memory pages that have already been released, leading to a use-after-free condition. A local attacker could exploit this vulnerability to cause memory corruption, potentially resulting in a system crash and denial of service (DoS).

This vulnerability is rated as Low severity because triggering the issue requires specific error conditions during asynchronous kTLS socket decryption under cryptographic backlog pressure, limiting the blast radius primarily to a local denial of service. The in-kernel TLS subsystem is not enabled or utilized by default system services. Furthermore, Red Hat Enterprise Linux kernels do not include the upstream commit that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.