PT-2025-34980 · Linux +1 · Linux Kernel +1

Published 2025-08-28 · Updated 2025-08-28 · CVE-2024-58240

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Linux kernel (affected versions not specified)

Description:

The Linux kernel contains an issue related to Transport Layer Security (TLS) where asynchronous decryption request handling is not separated from synchronous handling. This complexity introduces potential issues in managing decryption requests, particularly when asynchronous operations are not in use. The handling is simplified without asynchronous operations, eliminating the need for reference counting and relying on completion events for results. A previous fix addressed a potential Use-After-Free (UAF) condition.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-58240

Affected Products

Debian

Linux Kernel

References · 10

• https://security-tracker.debian.org/tracker/source-package/linux · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-58240 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-58240 · Vendor Advisory
• https://twitter.com/CVEnew/status/1961003452114350428 · Twitter Post
• https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186 · Note
• https://packages.debian.org/src:linux · Note
• https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5 · Note
• https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011 · Note
• https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d · Note