CVE-2026-74578

Status: UPDATED  |  Advisory ID: CVE-2026-74578

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_skcipher - force synchronous processing on trees without ctx->state

The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv

directly into the skcipher request. After io_submit() the socket lock is

dropped and the request is processed asynchronously, so a concurrent

sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request

run under an attacker-controlled IV. For CTR/stream modes this is

IV/keystream reuse and lets an unprivileged user recover the plaintext of

a concurrent operation.

Snapshotting ctx->iv into per-request storage for the async path is not

sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -

the MSG_MORE inter-chunk IV chaining is carried solely by the in-place

req->iv writeback, which a snapshot redirects into per-request memory that

af_alg_free_resources() releases on completion, silently producing wrong

output. Writing the IV back from the completion callback instead is not

possible either: that would require lock_sock() there, but the callback can

run in softirq/atomic context, so it must not sleep.

Make the operation synchronous instead, which removes both the IV race and

any writeback race. This is equivalent to the upstream resolution, commit

fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the

AIO socket path across net/ entirely and so produces the same end state for

this file. This patch deviates from that commit deliberately: rather than

removing AIO socket support tree-wide, which would be far too invasive for

stable, it removes only the AIO branch in crypto/algif_skcipher.c.

io_submit() now completes synchronously; AF_ALG async is rarely used in

practice.

The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,

and is left alone to keep the fix minimal.

Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000

after the change; MSG_MORE chunked CTR output bit-identical to single-shot. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References