CVE-2024-26584
A critical flaw in the Linux kernel’s crypto subsystem can allow attackers to cause denial of service by manipulating crypto request backlogging. The issue occurs when the crypto API returns -EBUSY instead of -EINPROGRESS, leading to duplicate callbacks and potential resource exhaustion. It has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users, especially those running older kernel versions that have not applied the latest security updates.
Real-world impact
An attacker could trigger a denial of service by exhausting kernel crypto resources, potentially causing system instability or crashes.
Why this severity
The CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability, and the fact that the vulnerability can be exploited remotely without authentication or user interaction.
What to do about it
- 011. Check your current kernel version.
- 022. Update to a kernel version that includes the fix for CVE-2024-26584 (e.g., the latest stable release).
- 033. Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Feb 21, 2024 · Feb 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.