Linux kernel crypto: skcipher request size left uninitialized, causing memory corruption and crashes

Impact

The newer cra_reqsize field in crypto_alg was wired up for ahash and acomp but not for skcipher, so skcipher algorithms that set cra_reqsize instead of calling crypto_skcipher_set_reqsize() end up with an under-sized request allocation in the framework. The result is kernel memory corruption and crashes, as reproduced by the reporter. Every symmetric-crypto consumer on a host sits on this path - dm-crypt on encrypted node disks, IPsec between nodes, in-kernel TLS - so the failure lands on the host kernel of a GPU node rather than in any one tenant. The record describes it as corruption and crash; it does not establish a controlled-exploitation path, and the trigger is use of an affected algorithm rather than any attacker-supplied input.

Who can reach it

Local, and conditional on the host running a skcipher algorithm that declares cra_reqsize. Any workload that drives that algorithm (directly or via dm-crypt, IPsec, kTLS) can reach the corrupted allocation; no special privilege is identified in the record beyond use of the kernel crypto API.

What to do

Take the stable kernel update that adds the proper crypto_skcipher_set_reqsize() calls in the affected init functions (commits in the record). No mitigation other than avoiding the affected algorithm is described upstream, and the advisory names no fixed release beyond those commits. Because it is a kernel change, affected nodes must be drained and rebooted; prioritize hosts using dm-crypt or IPsec, where the path is exercised constantly.

References

Related entries

• Linux kernel io_uring: registered-buffer folio offset miscalculated for unaligned user pointersCVE-2025-40216 · Linux kernel io_uring/rsrc (registered buffer folio coalescing)High
• Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if theCVE-2025-40274 · Linux kernel (virt/kvm)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• VMware Aria Operations / VMware Tools: Local privilege escalation to root inside a managed VM via SDMP service discoveryCVE-2025-41244 · VMware Aria Operations / VMware ToolsHigh
• PAM (pam-config): Local user is treated as `allow_active` in PAMCVE-2025-6018 · PAM (pam-config)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd): A division by zero in the amdkfd (KFD compute driverCVE-2025-68174 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd)High