Executive brief
A vulnerability exists in the Linux kernel's cryptographic subsystem, specifically affecting how certain encrypted data is processed. This issue could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information. The flaw impacts various systems using the Linux kernel, including specific industrial automation controllers from Siemens.
Technical details
The vulnerability is located in the crypto/authencesn.c component of the Linux kernel. It stems from improper handling of high-order sequence bits (hiseq) during out-of-place decryption (where the source and destination buffers differ). Specifically, the code incorrectly placed these bits at the end of the destination buffer, which was unnecessary and led to incorrect data rearrangement for hashing. An attacker with local access could exploit this logic error to trigger memory corruption or bypass cryptographic protections. Patches have been released across multiple stable kernel branches to ensure proper buffer handling and data alignment during the decryption process.
Affected products
- Linux Linux crypto/authencesn.c
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-05-01: disclosed: Vulnerability published in NVD
- 2026-03-27: patched: Initial patch authored by Herbert Xu
References
- https://git.kernel.org/stable/c/153d5520c3f9fd62e71c7e7f9e34b59cf411e555
- https://git.kernel.org/stable/c/5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5
- https://git.kernel.org/stable/c/89fe118b6470119b20c04afc36e45b81a69ea11f
- https://git.kernel.org/stable/c/8c62f618576519dbed6816fafc623ce592953025
- https://git.kernel.org/stable/c/cded4002d22177e8deaca1f257ecd932c9582b6b
- https://git.kernel.org/stable/c/d0c4ff6812386880f30bc64c2921299cc4d7b47f
- https://git.kernel.org/stable/c/d589abd8b019b07075fda255ceab8c8e950cdb3f