Loading story…
A Linux kernel vulnerability in the TLS ULP subsystem can trigger a use-after-free in tls_sk_proto_close() when one thread closes a TLS socket while another concurrently calls setsockopt(SOL_TLS, TLS_TX). The flaw stems from a race in TLS socket teardown and state manipulation, and the original reporter said a reproducer exists, though it was mistakenly included in a public oss-security posting despite an intention to withhold it until a fix was available. The issue was reportedly shared with linux-distros before a fix had been accepted upstream, with public disclosure occurring later on oss-security.
Follow-up discussion on the mailing list pointed to taking lock_sock(sk) earlier in tls_sk_proto_close() as the most natural mitigation because the function already acquires that lock unconditionally. Reviewers said the bug may reflect a broader locking-order problem worth auditing in similar kernel paths, and the reporter said the proposed locking change would be raised with Linux kernel networking maintainers while a fix is discussed.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Aretiq published research describing CVE-2026-3593 in ISC BIND 9's DNS-over-HTTPS implementation, explaining that repeated HTTP/2 SETTINGS changes to INITIAL_WINDOW_SIZE can trigger a use-after-free. The write-up says the issue reliably crashed ASAN-instrumented or hardened builds in testing, while default jemalloc-based production builds did not crash.
ISC fixed the DNS-over-HTTPS HTTP/2 SETTINGS use-after-free vulnerability CVE-2026-3593 in BIND 9 versions 9.20.23, 9.21.22, and 9.20.23-S1. The fix nulls the HTTP/2 response buffer pointer before releasing the request structure.
Oleg Sevostyanov publicly disclosed a Linux kernel TLS ULP race condition that can trigger a use-after-free in tls_sk_proto_close() via close() and setsockopt(SOL_TLS, TLS_TX). Follow-up discussion noted a reproducer was mistakenly included in the public archives despite an intent to withhold it until a fix was available.
The disclosure timeline for the Linux kernel TLS ULP use-after-free listed 2026-05-30 as the latest proposed date for public disclosure. The later oss-security discussion says the eventual public post occurred after that date.
The Linux kernel TLS ULP use-after-free vulnerability was reported to the linux-distros list before a fix had been accepted by kernel maintainers. Multiple oss-security references explicitly state this happened on 2026-05-16.
ISC published a knowledge base advisory for CVE-2022-1183, titled "Destroying a TLS session early causes assertion failure." The reference provides the publication date but no additional event details in the synopsis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
aretiq.ai
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcekb.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026
**CVE-2024-36489** affects the Linux kernel TLS subsystem because `tls_init()` lacked a write memory barrier. On systems permitting store-store reordering, TLS `setsockopt` or `getsockopt` operations can observe an uninitialized `ctx->sk_proto` value and trigger a NULL-pointer dereference, creating an availability risk. Red Hat rates the flaw Low severity, with a product-specific CVSS v3.1 score of 6.1; NVD scores it 5.5. Upstream fixes are available in Linux kernel versions 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, and 6.10-rc1. Red Hat issued errata for affected RHEL 8 and RHEL 9 kernel and kernel-rt streams, including relevant EUS and specialized-support offerings, while RHEL 6 is not affected. Organizations should identify hosts running affected kernel builds and apply the applicable vendor kernel updates.
Aug 26, 2026
Researchers detailed **CVE-2024-27394**, a Linux kernel use-after-free flaw in the TCP Authentication Option (**TCP-AO**) implementation, linking the bug to incorrect use of the kernel’s **Read-Copy Update (RCU)** synchronization model. The issue affects `tcp_ao_connect_init()` in `net/ipv4/tcp_ao.c`, where the kernel iterates over TCP-AO keys with an RCU list macro and schedules key reclamation with `call_rcu()` without remaining inside an RCU read-side critical section, creating a window in which a freed key can still be accessed. The analysis showed the bug can be prepared through `setsockopt(TCP_AO_ADD_KEY)` and triggered during `connect()` on IPv4 TCP sockets, with a proof of concept reportedly reproducing the fault on Linux kernel `6.8.4` under KASAN and `CONFIG_PREEMPT`. Researchers said the race can be made more reliable by forcing preemption with reschedule IPIs, widening the interval between reclamation and continued iteration. The fix replaces `hlist_for_each_entry_rcu` with `hlist_for_each_entry_safe` to prevent dereferencing a freed next node, and the patch was reported as merged in April and backported to stable kernels.
Jul 24, 2026