SB20260507287 - Improper input validation in Linux kernel crypto
Published: May 7, 2026
Security Bulletin ID
SB20260507287
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper input validation (CVE-ID: CVE-2026-43077)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in algif_aead when processing decryption requests. A local user can provide a crafted receive buffer size to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32
- https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548
- https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c
- https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94
- https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a
- https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174
- https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22
- https://git.kernel.org/stable/c/fd427dd84f224309afbcc2cb67c7bb770a01265c