LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26584: net: tls: handle backlogging of crypto requests

In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0. Compared to Sabrina's original patch this version uses the new tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-26584 is a Linux kernel TLS bug in how queued cryptographic work is handled. Public sources show it has been fixed in stable kernel updates, but they do not describe a proven real-world attack or business impact. Treat it as a kernel maintenance priority for systems using affected Linux kernels, especially where kernel TLS is relevant.

Executive priority

Schedule remediation through normal kernel patch cycles, escalating for critical Linux systems using TLS-heavy workloads. There is no public evidence of exploitation in the provided sources, but kernel flaws can be hard to isolate once widely deployed.

Technical view

The Linux kernel TLS path set CRYPTO_TFM_REQ_MAY_BACKLOG, allowing crypto_aead_encrypt/decrypt to return -EBUSY when work is backlogged. The fix treats that state like -EINPROGRESS and handles async callbacks correctly. Sources list Linux kernel as affected and reference stable kernel commits; no CVSS, CWE, or detailed impact is provided.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel versions where kernel TLS and asynchronous crypto paths are used. The source data does not identify specific distributions beyond a Fedora package announcement, nor does it confirm exposure for every Linux deployment.

Exploitation context

CISA KEV status is false, and the supplied sources do not claim active exploitation. The upstream description says the condition can occur when crypto request queues are full, but it does not provide a demonstrated exploit scenario or final security impact.

Researcher notes

Evidence is commit-level and incomplete for risk scoring. The core issue is backlog handling for crypto API returns in net/tls. Sources provide fixes but not CVSS, CWE, attacker prerequisites, or exploitability conclusions. Avoid assuming broad remote exploitability without additional vendor analysis.

Mitigation direction

  • Apply kernel updates from your Linux distribution or vendor that include the referenced stable fixes.
  • Prioritize internet-facing or high-throughput Linux systems that may use kernel TLS.
  • Track Fedora and other distribution advisories for packaged kernel availability.
  • If updates are delayed, consult vendor guidance for supported risk-reduction options.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and cloud images.
  • Compare installed kernels with vendor advisories and referenced stable commit fixes.
  • Review whether workloads use Linux kernel TLS or related crypto acceleration paths.
  • Confirm patched kernels are running after maintenance windows and reboots.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26584 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa54667f6728c2714a400f3c884727da74b6d1717, a54667f6728c2714a400f3c884727da74b6d1717, a54667f6728c2714a400f3c884727da74b6d1717, a54667f6728c2714a400f3c884727da74b6d1717, a54667f6728c2714a400f3c884727da74b6d1717unaffected
LinuxLinux4.16, 0, 5.15.160, 6.1.84, 6.6.18, 6.7.6, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.