do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 5.11 | 5.15.105 |
| linux / linux_kernel | 5.5 | 5.10.177 |
| linux / linux_kernel | 5.16 | 6.1.20 |
| linux / linux_kernel | 4.13 | 5.4.240.x |
| linux / linux_kernel | 6.2 | 6.2.7 |
| debian / debian_linux | 10.0 | 10.0.x |