Linux kernel pcrypt: EBUSY from backlogged requests is mishandled, corrupting completion accounting

Impact

The pcrypt parallel crypto template did not handle MAY_BACKLOG requests returning EBUSY, and did not filter the EINPROGRESS notifications that follow, so completion accounting for queued requests goes wrong. The upstream record is a terse fix commit with no exploitation analysis; what is established is incorrect handling of a crypto request state, with kernel instability the realistic outcome on an affected node. Exposure is narrow: pcrypt is only in the path when a workload or the IPsec stack is explicitly configured to use the pcrypt template, which is not the default on a typical GPU server. The NVD score of 9.8 with a network attack vector is an automated assignment that the commit message does not support - treat this as a host kernel correctness fix, not a remote compromise. On a GPU node the operational cost of an unplanned kernel fault is the real concern, since draining a node holding long-running training jobs is expensive.

Who can reach it

Reachable only where the pcrypt template is actually configured (for example parallelized IPsec or a workload driving the crypto API through pcrypt). A local user or a workload able to submit crypto requests through that path; no evidence in the record of a remote path despite the published AV:N vector.

What to do

Pick up the fix from a stable kernel series that contains the listed commits and reboot the affected nodes - a kernel update on a GPU host means drain and reboot, so it fits an ordinary maintenance window rather than an emergency one. Where pcrypt is not configured (check whether any crypto instance uses the pcrypt template), there is nothing to mitigate in the interim. No vendor advisory beyond the kernel commits exists in the record, and no single fixed release is named.

References

Related entries

• Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCVE-2026-46135 · Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error pathsCritical
• Linux kernel libceph: out-of-bounds access parsing a CRUSH map with mismatched bucket algorithm fieldsCVE-2026-52955 · Linux kernel libceph (crush_decode bucket algorithm parsing)Critical
• Linux kernel (net/rds): If RDS/IB queue-pair setup fails after the send ring is allocated but before the receive ringCVE-2026-53355 · Linux kernel (net/rds)Critical
• Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pagesCVE-2026-53363 · Linux kernel (net/xfrm)Critical
• Linux kernel nfsd: dangling IDR entry to freed layout stateid when nfsd4_layout_setlease() failsCVE-2026-53399 · Linux kernel nfsd (pNFS layout stateid teardown on setlease failure)Critical
• Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCVE-2026-63886 · Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCritical