CVE-2026-43078 (GCVE-0-2026-43078)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary. Add the check to the reassignment so that this does not happen. Also update the comment which still refers to the obsolete offset argument.
References
Impacted products
Vendor Product Version
Linux Linux Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
Version: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "2b781d1d4f933990318bcc5c68fb75a717379e42",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "f7826bc0b39928a4a22f6b815dd9940b22a63503",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "710a4ce5d7afd9fe082c75dec282ab4a11c0fe71",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "c8369a6d62f5abde9cbd4b62c45bf4b996be2468",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "9532501e0f1b200ea80baa0e33e0b06da10bb271",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "31d00156e50ecad37f2cb6cbf04aaa9a260505ef",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.254",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.204",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.170",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.137",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.85",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn\u0027t updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable AF_ALG skcipher/AEAD path is reached through local socket syscalls such as socket, bind, accept, sendmsg/sendmmsg, and recvmsg. It is not reachable directly from remote network input.\nAC:L - An attacker controls the AF_ALG socket state, TX scatterlist layout, and recv length needed to end processing on an SG boundary and trigger the zero-length reassignment. No race or external timing condition is required.\nPR:L - Creating and using PF_ALG sockets for userspace crypto does not require real root or administrative capabilities. A basic unprivileged local user can reach the affected code.\nUI:N - Exploitation only requires attacker-issued syscalls on the attacker\u0027s own AF_ALG socket. No victim action is needed.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority. This is standard local kernel attack surface rather than a VM or hardware boundary escape.\nC:H - The bug is kernel heap memory corruption immediately past an allocated scatterlist object. Following the higher-severity rule, this can plausibly be leveraged for kernel memory disclosure.\nI:H - The pre-fix code writes a scatterlist entry past the allocated destination array via sg_set_page. This is an out-of-bounds kernel heap write and can plausibly support privilege escalation or control-flow/object corruption.\nA:H - The issue is directly observed as a KASAN slab-out-of-bounds crash in af_alg_pull_tsgl from recvmsg. Repeated triggering can crash or destabilize the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:48.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"
        },
        {
          "url": "https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"
        },
        {
          "url": "https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"
        },
        {
          "url": "https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"
        }
      ],
      "title": "crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43078",
    "datePublished": "2026-05-06T07:40:15.092Z",
    "dateReserved": "2026-05-01T14:12:55.983Z",
    "dateUpdated": "2026-08-05T12:25:48.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.