CVE-2026-46033 Details

A vulnerability in the Linux kernel's crypto authentication encryption (authencesn) module allows for out-of-bounds access due to improper handling of hash digest sizes during instance creation. The issue arises because authencesn requires an authentication size (authsize) of either zero or at least four bytes. This requirement is crucial as the ESN encryption and decryption processes always move four bytes of high-order sequence number data at the end of the authenticated data. While the function 'crypto_authenc_esn_setauthsize()' correctly rejects non-zero authsizes in the range of one to three, the 'crypto_authenc_esn_create()' function failed to validate the digest size before copying it into the instance's maximum authentication size. Consequently, this oversight allowed the AEAD core to initialize the transformation's default authsize with an invalid value. When an ahash with a digest size of one to three, such as cbcmac(cipher_null), was selected, it exposed authencesn instances with incorrect default authsize settings. The AF_ALG interface could then exploit this by triggering the ESN tail processing with a too-short tag, leading to an out-of-bounds access.

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.