CVE-2024-26583
This vulnerability is a race condition in the Linux kernel’s TLS implementation that can allow an attacker to crash the system or potentially execute arbitrary code. It occurs when asynchronous crypto notifications and socket closures happen concurrently, leading to a use‑after‑free error. The issue has been fixed in recent kernel updates.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (all distributions) – any system running a kernel version before the patch that contains the race condition in the TLS async notification handling.
Real-world impact
An attacker could crash the system or potentially execute arbitrary code by exploiting the race condition, leading to denial of service or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects the high impact of the vulnerability: it can be exploited remotely with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the CVE-2024-26583 fix.
- 02Reboot or reload the kernel to apply the update.
NVD-referenced vendor advisory
Timeline
- Feb 21, 2024 · Feb 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.