Junglewise Threat Intelligence

CVE-2026-23060: Linux kernel NULL pointer dereference in crypto authencesn

CVE-2026-23060 · Severity: medium · CVSS 5.5 · Published 2026-02-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's cryptographic module could allow a local user to crash the system. The issue occurs when the system processes specifically malformed encrypted network traffic data. This results in a 'kernel panic,' which forces the system to shut down or restart, potentially causing a denial of service for critical operations or industrial equipment using affected software.

Technical details

A NULL pointer dereference vulnerability exists in the Linux kernel's crypto/authencesn.c component. The function crypto_authenc_esn_decrypt() assumes an ESP/ESN-formatted AAD and does not verify if the associated data length (assoclen) meets the minimum requirement of 8 bytes. When provided with a shorter length, the code can advance past the end of the destination scatterlist, triggering a NULL pointer dereference in scatterwalk_map_and_copy(). This results in a kernel panic (Denial of Service). The issue has been addressed by adding a minimum AAD length check in both encryption and decryption paths.

Affected products

  • Linux Linux 104880a6b470 to df22c9a65e9a9daa368a72fed596af9d7d5876bb
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-16: disclosed: Vulnerability reported by Taeyang Lee
  • 2026-01-30: patched: Fix committed to Linux stable tree
  • 2026-02-04: advisory: CVE-2026-23060 published

References

Related threats