CVE-2024-58240: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-58240 is a vulnerability in the Linux kernel related to TLS (Transport Layer Security) handling, specifically concerning the separation of no-async decryption request handling from async operations. The vulnerability was disclosed on August 28, 2025, and affects various Linux kernel versions across multiple distributions (NVD).

The vulnerability involves the TLS subsystem in the Linux kernel where the handling of non-async operations needed to be separated from async operations. The fix simplifies the handling when async operations are not in use, eliminating the need for reference counting and only requiring completion wake-up for result returns. The vulnerability has received a CVSS v3 Base Score of 7.0 with High Attack Complexity and Local Attack Vector (Rapid7).

While specific impact details are limited in the available sources, the vulnerability affects multiple Linux distributions and kernel versions, particularly impacting TLS operations in the kernel. The high CVSS score of 7.0 indicates significant potential impact on system security (Rapid7).

Multiple Linux distributions have released patches to address this vulnerability. Ubuntu has released fixes for various kernel versions including linux-kvm (5.15.0-1069.74), linux-azure (5.15.0-1075.84), and linux-gcp (5.15.0-1071.79). Additionally, fixes have been implemented in linux-aws and other kernel variants (Ubuntu).