CVE-2026-23344

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23344", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.999Z", "datePublished": "2026-03-25T10:27:31.795Z", "dateUpdated": "2026-05-11T22:05:01.536Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:01.536Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix use-after-free on error path\n\nIn the error path of sev_tsm_init_locked(), the code dereferences 't'\nafter it has been freed with kfree(). The pr_err() statement attempts\nto access t->tio_en and t->tio_init_done after the memory has been\nreleased.\n\nMove the pr_err() call before kfree(t) to access the fields while the\nmemory is still valid.\n\nThis issue reported by Smatch static analyser"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev-tsm.c"], "versions": [{"version": "4be423572da1f4c11f45168e3fafda870ddac9f8", "lessThan": "79a26fe3175b9ed7c0c9541b197cb9786237c0f7", "status": "affected", "versionType": "git"}, {"version": "4be423572da1f4c11f45168e3fafda870ddac9f8", "lessThan": "889b0e2721e793eb46cf7d17b965aa3252af3ec8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/ccp/sev-dev-tsm.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/79a26fe3175b9ed7c0c9541b197cb9786237c0f7"}, {"url": "https://git.kernel.org/stable/c/889b0e2721e793eb46cf7d17b965aa3252af3ec8"}], "title": "crypto: ccp - Fix use-after-free on error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev-tsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "79a26fe3175b9ed7c0c9541b197cb9786237c0f7", "status": "affected", "version": "4be423572da1f4c11f45168e3fafda870ddac9f8", "versionType": "git"}, {"lessThan": "889b0e2721e793eb46cf7d17b965aa3252af3ec8", "status": "affected", "version": "4be423572da1f4c11f45168e3fafda870ddac9f8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/ccp/sev-dev-tsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8ACF56ED-6FE0-41DE-BECE-41134CC7BD44", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix use-after-free on error path\n\nIn the error path of sev_tsm_init_locked(), the code dereferences 't'\nafter it has been freed with kfree(). The pr_err() statement attempts\nto access t->tio_en and t->tio_init_done after the memory has been\nreleased.\n\nMove the pr_err() call before kfree(t) to access the fields while the\nmemory is still valid.\n\nThis issue reported by Smatch static analyser"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp - Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en la ruta de error\n\nEn la ruta de error de sev_tsm_init_locked(), el c\u00f3digo desreferencia 't' despu\u00e9s de que ha sido liberado con kfree(). La instrucci\u00f3n pr_err() intenta acceder a t->tio_en y t->tio_init_done despu\u00e9s de que la memoria ha sido liberada.\n\nMover la llamada a pr_err() antes de kfree(t) para acceder a los campos mientras la memoria a\u00fan es v\u00e1lida.\n\nEste problema reportado por el analizador est\u00e1tico Smatch"}], "id": "CVE-2026-23344", "lastModified": "2026-06-17T10:21:23.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:32.493", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/79a26fe3175b9ed7c0c9541b197cb9786237c0f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/889b0e2721e793eb46cf7d17b965aa3252af3ec8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: crypto: ccp - Fix use-after-free on error path", "id": "2451184", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451184"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's crypto: ccp module. A use-after-free vulnerability exists in the `sev_tsm_init_locked()` function's error handling path. This occurs when the system attempts to access memory that has already been released, leading to a memory corruption vulnerability. This could potentially result in system instability or a denial of service (DoS)."], "name": "CVE-2026-23344", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23344\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23344\nhttps://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23344-0279@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4be423572da1f4c11f45168e3fafda870ddac9f8,79a26fe3175b9ed7c0c9541b197cb9786237c0f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4be423572da1f4c11f45168e3fafda870ddac9f8,889b0e2721e793eb46cf7d17b965aa3252af3ec8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T22:03:26.278193+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that contains the ccp use\u2011after\u2011free fix", "If an update is not yet available, disable the ccp crypto module by unloading the module or compiling the kernel without it", "Reboot the system to load the updated kernel or disabled module configuration"], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Linux kernel binaries compiled from the vulnerable source tree are affected, including kernel releases 6.19 and all 7.0 release candidates (rc1 through rc7).", "description_and_impact": "The vulnerability is a use\u2011after\u2011free in the Linux kernel\u2019s crypto subsystem. The error path of sev_tsm_init_locked() dereferences a structure that has already been freed with kfree(). Accessing t->tio_en and t->tio_init_done after the memory release causes a kernel memory fault, resulting in a crash and a denial of service.", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw resides in kernel code and would generally require local privileged execution to trigger the error path. Even a single triggering event could crash the system, leading to a denial of service. The low EPSS suggests that widespread exploitation is unlikely at present."}}}}, "created": "2026-03-25T21:32:10.449977+00:00", "updated": "2026-04-28T22:15:41.360360+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}