Linux kernel AF_ALG: receive-side scatterlist extraction ignored the receive buffer budget

Impact

af_alg_get_rsgl() used the readable check only as a gate, so an RX scatterlist extraction could attach more data than the socket's receive buffer budget accounted for; the fix caps each extraction at the remaining budget and makes skcipher reject a recvmsg that cannot obtain space for one chunk instead of rounding the request down to zero. The record describes it as availability-only and local. Exposure on a GPU node depends entirely on whether tenant workloads can open AF_ALG sockets - many container runtimes do not permit AF_ALG, and nothing in the mainstream GPU stack needs it, so for most fleets this is unreachable from a tenant pod. Treat it as a correctness fix to carry with the next kernel rather than a reason to open a window.

Who can reach it

Local user able to open an AF_ALG socket and issue recvmsg against it; blocked where seccomp or the runtime denies the AF_ALG address family.

What to do

Take a stable kernel containing the referenced commits in the normal cycle and reboot nodes on your usual schedule. Where tenants should never touch the kernel crypto API at all, deny the AF_ALG family in the container runtime's seccomp profile - that closes the path without a reboot.

References

Related entries

• Linux kernel BPF: sleepable programs could attach to kprobe_multi and sleep in atomic contextCVE-2026-43010 · Linux kernel BPF (bpf_kprobe_multi_link_attach sleepable program check)Medium
• Linux kernel AF_ALG: missing SGL end-marker clearing lets a local user panic the host via sg_next() NULL dereferenceCVE-2026-43043 · Linux kernel AF_ALG crypto socket interface (af_alg_alloc_tsgl scatterlist chaining)Medium
• Linux kernel algif_aead: minimum receive-buffer check ignores the authentication tag during decryptionCVE-2026-43077 · Linux kernel algif_aead (AF_ALG AEAD receive buffer size check)Medium
• Linux kernel x86 shadow stacks: shstk_pop_sigframe ignores mmap_read_lock_killable() failure on signal returnCVE-2026-43109 · Linux kernel x86 shadow stacks (shstk_pop_sigframe mmap lock error handling)Medium
• Linux kernel EFI/CPER: oversized offset in a firmware error record makes the kernel dump arbitrary memoryCVE-2026-43171 · Linux kernel EFI/CPER firmware error reporting (cper_print_fw_err length underflow)Medium
• Linux kernel arm64: TSV110 CPUs were not getting the Spectre-BHB software mitigationCVE-2026-43261 · Linux kernel arm64 Spectre-BHB mitigation (TSV110 MIDR missing from the affected list)Medium