Executive brief
A vulnerability was identified in the Linux kernel's cryptographic component that could lead to a system crash. The issue occurs when the system processes specifically malformed requests for certain encryption methods (ChaCha20-Poly1305). While this primarily affects system stability, it could be used by a local attacker to cause a denial-of-service.
Technical details
A vulnerability exists in the chachapoly_create() function within crypto/chacha20poly1305.c of the Linux kernel. The function fails to validate the return value of crypto_attr_alg_name() when processing the poly1305 template argument. If the argument is missing, the function receives an error pointer and subsequently passes it to strcmp(), leading to an invalid pointer dereference. This can be exploited by a local user to cause a kernel oops or denial-of-service. The issue has been resolved by adding proper error checking to validate the template argument before string comparison.
Affected products
- Linux Linux Kernel 6.16 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-05-26: other: Vulnerability fixed in source code
- 2026-07-25: advisory: CVE published by NVD