CVE-2026-80843
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrm_state_construct() auth-trunc leak attach_auth_trunc() can allocate x->aalg while leaving x->props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real case is cmac(aes). xfrm_state_construct() then treats !x->props.aalgo as "no auth algorithm attached yet" and calls attach_auth(). That overwrites x->aalg and loses the first allocation. Any later failure or teardown only frees the replacement pointer. Check whether x->aalg is already attached instead of inferring that state from x->props.aalgo.
How to fix
- Linux Linux958ae9f261319e1cdc44879886bcda2263258cca, fb7f3e74789a3c89647f4eb768f6dfaf4a751e72, ba0c110c205855b3f1e3130d8c0fdb484d704c8c, c8837bbe792257af547fd1c0252553ce13148795, 71d42da01740ec6557837bebec0bc48cfc3b4c39, cf67361e78dca488d6e4df8396a53e6745a3a80e, 37426395cb90ef217beec8407a14bd82153793d3, be19d20e53a239572bb2a28efcc1cd2b069b1ef9, c12cbf56320fb633484ee0ca1fb7d68d6b64b213 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < 958ae9f261319e1cdc44879886bcda2263258cca, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < fb7f3e74789a3c89647f4eb768f6dfaf4a751e72, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < ba0c110c205855b3f1e3130d8c0fdb484d704c8c, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < c8837bbe792257af547fd1c0252553ce13148795, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < 71d42da01740ec6557837bebec0bc48cfc3b4c39, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < cf67361e78dca488d6e4df8396a53e6745a3a80e, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < 37426395cb90ef217beec8407a14bd82153793d3, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < be19d20e53a239572bb2a28efcc1cd2b069b1ef9, 4447bb33f09444920a8f1d89e1540137429351b6 ≤ v < c12cbf56320fb633484ee0ca1fb7d68d6b64b213, 2.6.33 | 958ae9f261319e1cdc44879886bcda2263258cca, fb7f3e74789a3c89647f4eb768f6dfaf4a751e72, ba0c110c205855b3f1e3130d8c0fdb484d704c8c, c8837bbe792257af547fd1c0252553ce13148795, 71d42da01740ec6557837bebec0bc48cfc3b4c39, cf67361e78dca488d6e4df8396a53e6745a3a80e, 37426395cb90ef217beec8407a14bd82153793d3, be19d20e53a239572bb2a28efcc1cd2b069b1ef9, c12cbf56320fb633484ee0ca1fb7d68d6b64b213 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.