Linux kernel AF_ALG: af_alg_pull_tsgl can reassign one page past the end of the scatterlist

Impact

When page reassignment was added to af_alg_pull_tsgl(), the surrounding loop bound was not updated, so the function can try to reassign one page more than the list holds - an off-by-one over kernel scatterlist state. This sits directly behind the AF_ALG socket interface, which unprivileged processes can open by default, so on a multi-tenant GPU node any tenant pod reaches it without extra capabilities. NVD rates it 7.8 local with high impact across the board, i.e. a path from tenant code to kernel memory corruption and host root on a node whose other GPUs belong to someone else. Affected branches go back to 4.14, so long-lived nodes are in scope, not just recent kernels.

Who can reach it

Local, any authenticated user or container process that can create an AF_ALG (AF_ALG/algif_*) socket. No special device access, no GPU access, no network reachability required.

What to do

Update to a stable kernel containing the fix (backports exist on five branches per the record) and reboot each node; kernel crypto code cannot be hot-patched or reloaded here. Where tenants have no need for the kernel crypto socket interface, denying socket(AF_ALG, ...) via seccomp in the pod runtime and keeping algif_* modules unloaded removes the exposure until the reboot window.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
• KVM x86: __get_sregs2() reads PDPTRs without SRCU protection, dereferencing memslots unsafelyCVE-2026-43214 · Linux kernel KVM x86 (__get_sregs2 PDPTR read, missing SRCU protection)High
• Linux kernel vhost-vdpa: ASID equal to ngroups passes validation, giving an out-of-bounds write in vdpa_simCVE-2026-43248 · Linux kernel vhost-vdpa / vdpa_sim (ASID group bound check)High
• Linux kernel mm: stale page->private survives page free and causes a use-after-free in the swap subsystemCVE-2026-43303 · Linux kernel mm/page_alloc (page->private not cleared in free_pages_prepare)High
• Linux kernel BPF verifier: register used by an indirect jump is not marked liveCVE-2026-43321 · Linux kernel BPF verifier (compute_insn_live_regs, gotox indirect jumps)High