Executive brief
A vulnerability was identified in the Linux kernel's cryptographic subsystem. It affects how the system validates buffer sizes during data decryption, which could lead to system instability or a crash. This issue primarily impacts the availability of the system rather than the confidentiality of user data.
Technical details
A vulnerability in the algif_aead component of the Linux kernel's crypto subsystem stems from an incorrect minimum RX size check during decryption. Specifically, the check for the minimum receive buffer size did not account for the authentication tag size. An attacker with local access could potentially exploit this flaw to cause a denial of service (system crash). The issue has been resolved by adjusting the length check to include the required extra length for the tag during decryption. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.14.1 to 5.10.254, 5.11 to 5.15.204, 5.16 to 6.1.170, 6.2 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-04-12: patched: Initial fix in mainline kernel tree
References
- https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32
- https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548
- https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c
- https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94
- https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a
- https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174
- https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22