CVE-2026-46028 Details
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity can update that shared state before the original request has fully completed, which can lead to inconsistent IV handling. Snapshot the IV into per-request storage when preparing the AEAD request, so in-flight operations no longer depend on mutable socket state.
A vulnerability in the Linux kernel's AF_ALG AEAD AIO request processing has been addressed. Previously, these requests relied on a socket-wide IV buffer, which could be altered by subsequent socket activities before the original request was completed. This inconsistency in IV management could lead to vulnerabilities in cryptographic operations. The issue has been fixed by modifying the IV handling to use per-request storage, ensuring that ongoing operations are not affected by changes in the socket's mutable state.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/08ea39a556ecd39b33c2b4888861001c6706a62e | kernel.org | Patch |
| https://git.kernel.org/stable/c/3d72f8c6490dc79210b64270740cb2a8619361a4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/46fdb39e83227b5d39f7c934a0947ea913f13c18 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5aa58c3a572b3e3b6c786953339f7978b845cc52 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a920cabdb0b7cf1f4e11a20524253ae5bd09092b | kernel.org | Patch |
| https://git.kernel.org/stable/c/c2138c9bd02af19e0b407376140cd5435b0d81da | kernel.org | Patch |
| https://git.kernel.org/stable/c/ebc235675f24b0e3f8bc92b8419471d42f837d8f | kernel.org | Patch |
| https://git.kernel.org/stable/c/fa0fcec9b49d58e71df7ede91ecd86855f608e85 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.14, < 5.10.254 >= 5.11, < 5.15.204 >= 5.16, < 6.1.170 >= 6.2, < 6.6.137 >= 6.7, < 6.12.85 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | kernel.org |