Executive brief
A vulnerability was identified in the Linux kernel's cryptographic subsystem that could lead to internal calculation errors. The issue occurs when the system processes specific types of encrypted data, potentially allowing a local user to cause system instability. This has been addressed by limiting the maximum size of certain data parameters to prevent mathematical overflows.
Technical details
An arithmetic overflow vulnerability exists in the Linux kernel's AF_ALG (crypto) interface, specifically within the AEAD (Authenticated Encryption with Associated Data) implementation in `crypto/af_alg.c`. The root cause is a lack of upper-bound validation on the associated data (AD) length provided via control messages in `af_alg_cmsg_send`. A local attacker can provide a large `aead_assoclen` value that triggers an overflow during TX buffer size checks. This could potentially lead to memory corruption or kernel instability. The fix introduces a cap on the AD length at 0x80000000 to ensure safe integer arithmetic. Patching is available in various stable kernel branches including 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, and 6.18.33.
Affected products
- Linux Linux Kernel 4.1 to 6.18.33
Timeline
- 2026-05-05: other: Vulnerability fixed in upstream source code
- 2026-06-24: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc
- https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193
- https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918
- https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c
- https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d
- https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431
- https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802