Linux kernel crypto authencesn: out-of-bounds access with a 1-3 byte ahash digest via AF_ALG

Impact

crypto_authenc_esn_create() copied the underlying ahash digest size into maxauthsize without validating it, so an authencesn instance built over a hash with a 1-3 byte digest (cbcmac(cipher_null) is the example) inherited a default authsize that setauthsize() would itself have rejected. The ESN paths always move four bytes of high-order sequence number, so the too-short tag drives an out-of-bounds access. The reachable path is AF_ALG, which an unprivileged local process can open where AF_ALG and the relevant crypto modules are enabled — that makes it a genuine local memory-corruption primitive on a multi-tenant GPU node where tenants get shell in a container without a seccomp profile blocking AF_ALG sockets. Scored local, low-privilege, high confidentiality and availability impact.

Who can reach it

Local unprivileged user able to create AF_ALG sockets — including a container tenant, unless the runtime's seccomp profile blocks socket(AF_ALG) as the Docker/Kubernetes defaults do. No authentication beyond having code execution on the host or in a guest container.

What to do

Take the fix in a patched stable kernel and reboot each node; the change is upstream across multiple stable branches (commits linked) and Red Hat lists RHEL 6 through 10 as affected, so check your vendor's errata for the build to install. Where a reboot cycle across the fleet cannot happen quickly, confirm that container runtimes deny AF_ALG in their seccomp profiles — that removes the unprivileged path this CVE describes.

References

Related entries

• Linux kernel (drivers/iommu/intel): Killing a VM that has a device attached through the VT-d nested/PASID path makesCVE-2026-52953 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (virt/kvm): A guest store that splits a page and lands on a datamatch-enabled ioeventfd reaches a BUG_ONCVE-2026-63806 · Linux kernel (virt/kvm)High
• Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18h: AVIC inter-processor-interrupt virtualization is unsafe onCVE-2026-64172 · Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18hHigh
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-68258 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel mlx5_core port / transceiver module EEPROM (MCIA register): The MCIA register can return 32 dwordsCVE-2026-68293 · Linux kernel mlx5_core port / transceiver module EEPROM (MCIA register)High
• Linux kernel (net/xfrm): Outbound policies rejected optional tunnel and BEET templates but never got the same check forCVE-2026-68420 · Linux kernel (net/xfrm)High