CVE-2024-26585
A race condition in the Linux kernel’s TLS implementation could allow an attacker to crash the system. The flaw occurs when a socket is closed while asynchronous cryptographic work is still pending. The issue has been fixed in a recent kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users, regardless of distribution, are potentially affected until they apply the latest kernel update that contains the patch.
Real-world impact
An attacker could trigger a denial‑of‑service by sending crafted TLS traffic that exploits the race, causing the kernel to crash or behave unpredictably, which could lead to service interruption.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact (complete compromise of confidentiality, integrity, and availability) combined with its ease of exploitation: it requires no special privileges, no user interaction, and can be triggered remotely over the network.
What to do about it
- 01Update the Linux kernel to a version that includes the CVE-2024-26585 fix.
NVD-referenced vendor advisory
Timeline
- Feb 21, 2024 · Feb 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.