CVE-2024-58240
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
28/08/2025
Last modified:
29/08/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
tls: separate no-async decryption request handling from async<br />
<br />
If we&#39;re not doing async, the handling is much simpler. There&#39;s no<br />
reference counting, we just need to wait for the completion to wake us<br />
up and return its result.<br />
<br />
We should preferably also use a separate crypto_wait. I&#39;m not seeing a<br />
UAF as I did in the past, I think aec7961916f3 ("tls: fix race between<br />
async notify and socket close") took care of it.<br />
<br />
This will make the next fix easier.