Executive brief
A vulnerability in the Linux kernel's cryptographic subsystem could allow a local user to cause system crashes or potentially corrupt memory. The issue stems from how the system handles memory allocation requests for certain encryption algorithms. This could impact the overall stability and security of the operating system, potentially leading to a denial of service or unauthorized data access.
Technical details
A vulnerability exists in the Linux kernel's crypto/skcipher.c due to improper initialization of the request size (reqsize) when using the cra_reqsize field in the crypto_alg struct. While cra_reqsize was introduced to replace type-specific fields, the skcipher framework was not updated to correctly propagate this value during algorithm initialization. This discrepancy leads to incorrect memory allocation for cryptographic requests, resulting in memory corruption and kernel crashes. The issue is triggered when skcipher algorithms are initialized without explicit calls to crypto_skcipher_set_reqsize(). Patches have been released to ensure proper set_reqsize calls are made during the skcipher init function.
Affected products
- Linux Linux Kernel 6.16 to 6.17.4
Timeline
- 2025-10-07: patched: Initial patch authored by T Pratham
- 2025-11-12: disclosed: CVE published