CVE-2024-26582: Linux kernel kTLS Use-After-Free
CVE-2024-26582 is verified against torvalds/linux · github affected versions: Linux 6.2.0 through 6.6.18; also 6.1.x before 6.1.82, 6.7.x before 6.7.7 vulnerability class: Use-After-Free This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00265.
pruva-verify REPRO-2026-00265 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00265/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Use-after-free in the Linux kernel kTLS (in-kernel TLS) software receive path in net/tls/tls_sw.c. tls_decrypt_done() incorrectly frees pages belonging to clear_skb when decryption happens asynchronously. Affected Linux 6.2.0 through 6.6.18. Fixed in 6.8-rc3, 6.7.7+, 6.6.19+, 6.1.82+ via commit 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f. Reproduction requires a VM with CONFIG_TLS=y, a kTLS session, async decryption path, and partial read pattern. This is a kernel-space UAF, making it challenging for userspace-only backends.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.