Executive brief
The Linux kernel's IPsec transformation (xfrm) subsystem contains a memory leak in how it constructs authentication algorithm state. When handling certain authentication algorithms like CMAC(AES), the kernel may allocate memory and then lose track of it, wasting memory resources. While not directly exploitable for privilege escalation, this leak can degrade system performance and availability over time as memory accumulates without being freed.
Technical details
The vulnerability is a memory leak in the xfrm_state_construct() function in net/xfrm/xfrm_user.c. The attach_auth_trunc() function can allocate x->aalg (authentication algorithm structure) while leaving x->props.aalgo (algorithm identifier) at zero for auth algorithms without a sadb_alg_id (such as CMAC(AES)). The code then incorrectly infers the presence of an auth algorithm by checking only !x->props.aalgo, causing xfrm_state_construct() to call attach_auth(), which overwrites the first allocation. The leaked memory is only freed if the replacement pointer is used, but the original allocation is permanently lost. The fix changes the condition from checking !x->props.aalgo to checking !x->aalg directly, preventing the double-allocation and leak.
Affected products
- Linux Linux kernel 5.10 through 6.9+ (likely affecting many versions)
Timeline
- 2026-09-04: disclosed: CVE-2026-80843 published
- 2026-09-02: patched: Patch committed by Greg Kroah-Hartman
- 2026-07-28: other: Original fix authored by Zihan Xi