Executive brief
A vulnerability was identified in the Linux kernel's cryptographic subsystem (pcrypt) that could lead to system instability. The issue occurs when the system attempts to process encryption tasks in parallel but fails, falling back to a standard method without properly resetting internal tracking mechanisms. This could result in the system attempting to execute code for a task that was never properly registered, potentially leading to crashes or unpredictable behavior.
Technical details
The vulnerability exists in the pcrypt AEAD (Authenticated Encryption with Associated Data) implementation within the Linux kernel. When `padata_do_parallel()` returns `-EBUSY`, pcrypt falls back to calling the child AEAD directly. However, it previously failed to restore the original request callback and callback data before this fallback. Consequently, if an asynchronous completion occurs, the system may execute `pcrypt_aead_done()` for a request that was never enrolled in the padata infrastructure. This is a race condition/logic error in the crypto request handling path. The fix involves explicitly calling `aead_request_set_callback` to restore the original state before the fallback call.
Affected products
- Linux Linux kernel 5.10.231 to 5.10.261; 6.6.2f2f13e66d to 6.6.c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf
Timeline
- 2026-07-25: advisory
- 2026-07-24: patched
References
- https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372
- https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880
- https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5
- https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412
- https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18
- https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36
- https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf